Content Security Policy for AnyReplay

If your site sends a Content-Security-Policy header, the browser blocks anything it does not list. A recorder blocked by CSP fails quietly — the page works, no sessions arrive — so add these directives before you deploy the snippet.

The hosts

Script tag install

Content-Security-Policy:
  script-src 'self' https://cdn.anyreplay.com 'nonce-RANDOM';
  connect-src 'self' https://in.anyreplay.com;

The snippet itself is an inline script, so it needs to be allowed like any other inline script: give the <script> a nonce attribute matching the header, allow its hash, or move its contents into a file you serve from your own origin. If your policy uses 'strict-dynamic', the recorder script added by a nonced snippet is trusted automatically and the CDN host does not need listing.

npm install

Content-Security-Policy:
  connect-src 'self' https://in.anyreplay.com;

The recorder is part of your own bundle, so only the ingest host is needed.

Next.js

If you set CSP in middleware.ts with a per-request nonce, pass the nonce to both Script elements in the layout (<Script nonce={nonce} …>) and add the hosts above. With the client component install, only connect-src is needed.

What is not needed

• No worker-src: the recorder does not start web workers.
• No img-src, style-src or font-src changes: recording reads your page, it does not load anything into it.
• No frame-src: nothing is embedded in your site. Replay happens in the AnyReplay dashboard.

Self-hosted

For a self-hosted install, list your own recorder and ingest hosts instead — whatever NEXT_PUBLIC_CDN_URL and ingestUrl point at.

Testing a policy

Ship the policy as Content-Security-Policy-Report-Only first and watch the console: violations are reported without being enforced. A violation naming in.anyreplay.com means connect-src is missing it; one naming ar.min.js means script-src is. When the setup page says Connected, switch to the enforcing header.