CSP & Domains

Websites that use Content Security Policy (CSP) might not allow default access to domains managed by Verada which are required for its various services and features to function correctly.

This page documents the CSP directives needed to enable Verada's full functionality and is split into two guides, for Simple and Advanced CSP configurations.

Simple CSP configuration

Use the details in this section if your website uses a simple configuration that only makes use of the default-src CSP directive.

If your website allows wildcard domain values:

The following values for the default-src directive will be enough to enable all Verada services:

'unsafe-inline'
*.fanplayr.com
d38nbbai6u794i.cloudfront.net

Note, the unsafe-inline keyword value is required for Verada widgets.

If your website does NOT allow wildcard domain values:

You will need to list each domain used by Verada individual in the default-src directive to enable all services:

'unsafe-inline'
cdn.fanplayr.com
static.fanplayr.com
d38nbbai6u794i.cloudfront.net
my.fanplayr.com
e1.fanplayr.com
w1.fanplayr.com
runtime.fanplayr.com
runtime-apne1.fanplayr.com
runtime-use1.fanplayr.com
runtime-eus1.fanplayr.com
collect.fanplayr.com
recommendations.fanplayr.com
site-speed.fanplayr.com
fonts.fanplayr.com

Note, the unsafe-inline keyword value is required for Verada widgets.

Advanced CSP configuration

Use this guide if your website uses more than just the default-src CSP directive. As your website uses other more specific directives, you will need to allow access to Verada's domains for multiple directives to enable all services.

INFO

Each of the sections below describe a CSP directive and the most specific values needed for Verada to operate correct. If your website allows wildcard domains, many of the values can be shortened to *.fanplayr.com.

script-src

'unsafe-inline'
cdn.fanplayr.com
static.fanplayr.com
d38nbbai6u794i.cloudfront.net
my.fanplayr.com
e1.fanplayr.com
w1.fanplayr.com
runtime.fanplayr.com
runtime-apne1.fanplayr.com
runtime-use1.fanplayr.com
runtime-eus1.fanplayr.com
ajax.googleapis.com

Note, the unsafe-inline keyword value is required for Verada widgets.

style-src

'unsafe-inline'
fonts.fanplayr.com

Note, the unsafe-inline keyword value is required for Verada widgets.

img-src

cdn.fanplayr.com
collect.fanplayr.com
d38nbbai6u794i.cloudfront.net

font-src

fonts.fanplayr.com

connect-src

d38nbbai6u794i.cloudfront.net
merchandising.fanplayr.com
recommendations.fanplayr.com
site-speed.fanplayr.com
cdn.fanplayr.com
runtime.fanplayr.com
runtime-apne1.fanplayr.com
runtime-use1.fanplayr.com
runtime-eus1.fanplayr.com

Domain List

The following briefly outlines the primary purpose of each Verada-managed domain:

Domain	Description
cdn.fanplayr.com static.fanplayr.com d38nbbai6u794i.cloudfront.net fonts.fanplayr.com	Content delivery network
ajax.googleapis.com	Google content delivery network (used for loading Web Font loader library).
my.fanplayr.com e1.fanplayr.com w1.fanplayr.com	Page tracking and segmentation evaluation
runtime.fanplayr.com runtime-use1.fanplayr.com runtime-eus1.fanplayr.com runtime-apne1.fanplayr.com	Page tracking and segmentation evaluation
collect.fanplayr.com site-speed.fanplayr.com	Analytics tracking
recommendations.fanplayr.com merchandising.fanplayr.com	Product recommendation service
webpush.fanplayr.com	Web push notification service