What is a Content Security Policy (CSP)?

A Content Security Policy (CSP) is an HTTP response header, or meta tag, through which a site declares which origins the browser may load scripts, styles, images and network connections from on that page.

Why it matters

CSP is one of the strongest defences against injected scripts, and a strict one blocks anything it was not told about. That includes a session replay SDK: if the script host or the ingest endpoint is missing from the policy, the recorder either never loads or records and then fails to upload.

The failure is quiet. The page works, the console shows a CSP violation, and no sessions appear. Whoever installs a recorder needs to know exactly which directives to touch, and the vendor needs to keep that list short and stable.

How AnyReplay handles it

AnyReplay needs two things from your policy. The script-src directive must allow the host you load the SDK from, whether that is the AnyReplay CDN or your own bundle if you import @anyreplay/browser and ship it yourself. The connect-src directive must allow your ingest origin, https://in.anyreplay.com by default, or your own host when you self-host, so chunked uploads and the sendBeacon flush can reach it. If the recorder loads but no sessions arrive, check connect-src first. On the dashboard side the concern is reversed, and the replay sandbox iframe carries no allow-scripts. Your origin allow-list is the server-side counterpart.