Skip to main content
If you use Content Security Policy in your game or on your web page, this guide helps you to make sure Theymes SDK works with your policy.

​
Scripts

If your CSP includes script-src or default-src directive, you must make sure that:
  • The policy allows the page to load Theymes SDK script from assets.theymes.com. If you installed the SDK from NPM, this is not necesary.
  • The policy allows Theymes SDK to execute its inline scripts. You can either do this by specifying 'unsafe-inline' keyword, or using a nonce.
You should avoid using ‘unsafe-inline’ in production, because it defeats much of the purpose of having a CSP. Using nonce is much better alternative.
To use a nonce, you should generate a random string when the page is rendered, and then specify it in your CSP with 'nonce-{RANDOM}' keyword in your directive. When calling theymes.initialize() you should pass the nonce in the options argument. The SDK will then inject the nonce to all inline script tags. Here’s an example CSP that includes a valid script-src policy:

​
Connect & frames

If your CSP includes frame-src, connect-src or default-src directives, you must make sure that the policy allows your Theymes domain, eg. <company>.theymes.com. Here’s an example CSP that includes a valid frame-src and connect-src policy:

​
Stylesheets

If your CSP includes style-src or default-src directive, you must make sure that the policy allows inline stylesheets from Theymes SDK. You can do this either by using 'unsafe-inline' keyword, or using a nonce. See the scripts section for information about using a nonce.
Theymes always uses the same nonce passed to theymes.initialize() for both inline scripts and stylesheets.
Here’s an example CSP that includes a valid style-src policy:

​
Custom fonts

The default branding for games in Theymes uses custom google fonts. If you want to use the default fonts, you should enable google fonts. The google fonts domain is https://fonts.gstatic.com.
If you use custom fonts, and you use either font-src or default-src, you must make sure that the policy allows those fonts to be loaded. Here is an example CSP that includes a valid font-src policy for google fonts: