Content Security Policy

Permissions Policy and Content Security Policy (CSP) add a layer of security to your app. If you set either one, it must allow Footprint's features and domains. This page lists the values to add.

How you set these headers depends on your framework, but the policies need to include these values:

json
1{
2  key: 'Permissions-Policy',
3  value: 'camera=(self "https://*.onefootprint.com/*"), publickey-credentials-get=(self "https://*.onefootprint.com/*"),  otp-credentials=(self "https://*.onefootprint.com/*"), clipboard-write=(self "https://*.onefootprint.com/*")'
4},
5{
6  key: 'Content-Security-Policy',
7  value: 'child-src onefootprint.com; connect-src *.onefootprint.com https://fp.risk.onefootprint.com https://fpnpmcdn.net; frame-src *.onefootprint.com;'
8}

• Footprint identity verification flows use the browser's public key credentials to register and verify passkeys.
• Flows that collect identity documents and selfies also use the camera.
• Some features write to the clipboard, such as copying the test ID in sandbox.

MDN documents the Permissions Policy header in full.

Footprint's integrations run in an iframe for compliance and security reasons, so Footprint's domains must be allowed in child-src, connect-src, and frame-src.

MDN documents Content Security Policy in full.