Content Security Policies (CSP)

Transcend Consent Management can optionally generate a Content Security Policy for your site. We can construct this policy using current user consent data in combination with your configured data flows. Note that Regular Expression and Query Parameter data flow rules are not used when generating Content Security Policies.

Content Security Policy (CSP) is a browser feature which can add a layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks.

CSP can be activated by setting your Unknown Request Policy to Block in the Consent Management Developer Settings page of your Admin Dashboard.

Your CSP mode can be configured via the airgap.js CSP API. Note that your Unknown Request Policy must be set to Block in order to use a CSP.

Lax mode prevents your visitors from establishing connections to websites that have not been confirmed in your Data Flows. This mode allows for user consent to change without a page refresh. This is the default mode used when Unknown Request Policy is set to Block.

In order to use this mode, specify data-csp="allow-subdomains allow-known-hosts" on your airgap.js script tag.

Strict mode prevents your visitors from establishing connections to websites (and their subdomains) that are not allowed based on user tracking consent. This mode requires a page refresh whenever user tracking consent changes. This mode can be used to reliably cover all of our direct regulation gaps.

In order to use this mode, specify data-csp="strict" on your airgap.js script tag.

Set data-csp="off" on your airgap.js script tag to disable CSP generation. Transcend Consent Management will still provide protection against most network-based tracking. See our Regulation Roadmap for a list of network interfaces that we do not yet directly regulate without CSP.

Our consent manager connects to the following origins by default. Make sure to add these domains to your existing CSP to ensure that our consent manager can function properly: