CSP configuration | NookDocs

If your site sends a strict Content-Security-Policy header, it also applies to the docs served at acme.com/docs (same origin, via your reverse proxy). A too-tight policy blanks the page, drops styles, or breaks the AI assistant. Allow the directives below.

No CSP on your domain? Nothing to do — skip this page. This only matters when you're already sending a Content-Security-Policy and now host docs under it.

Recommended directives

default-src 'self';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https:;
font-src 'self' data:;
connect-src 'self' https://*.nookdocs.site;
frame-src 'self' https://www.youtube.com https://player.vimeo.com;

Directive	Why NookDocs needs it
`script-src 'unsafe-inline'`	Framework hydration + inline JSON-LD. Use a nonce instead if you can mint one per request.
`style-src 'unsafe-inline'`	Theme tokens (`--docs-*`) are applied as inline styles.
`img-src data: https:`	Logos/favicons (data: + your assets) and any external images in your content.
`font-src 'self' data:`	Bundled + embedded fonts.
`connect-src https://*.nookdocs.site`	The AI assistant + search call back to the platform. Drop if you don't use the assistant.
`frame-src ...`	Only if you embed videos/iframes via `<Video>` / `<Embed>`. Add the hosts you actually use.

Tightening with a nonce

'unsafe-inline' for scripts is the simple path. If your platform injects a per-request nonce, prefer:

script-src 'self' 'nonce-{REQUEST_NONCE}';

and drop 'unsafe-inline' from script-src. Styles still need 'unsafe-inline' (theme tokens are inline style attributes, which nonces don't cover).

Where to set it

Cloudflare — a Transform Rule or a response.headers set in the Worker.
Vercel — headers in vercel.json or next.config.js.
CloudFront — a Response Headers Policy on the /docs* behavior.

After changing the policy, hard-reload and check the browser console for blocked-resource warnings.