Skip to main content
Question

Content-Security-Policy: calendly requires unsafe capabilities

  • 26 July 2024
  • 3 replies
  • 138 views

Hi,

We’re setting up the calendly integration but are surprised to see that it doesn’t work without greatly relaxing the Content-Security-Policy in use in our app: in order to work, calendly requires the ‘unsafe-inline' and ‘unsafe-eval’ on both the script-src and style-src fetch directives. This is making us more exposed to CSRF and XSS attacks.

So my question is: are you aware of this, and are you planning to update your JS code?
Thanks

3 replies

V

Hi,

We’re setting up the calendly integration but are surprised to see that it doesn’t work without greatly relaxing the Content-Security-Policy in use in our app: in order to work, calendly requires the ‘unsafe-inline' and ‘unsafe-eval’ on both the script-src and style-src fetch directives. This is making us more exposed to CSRF and XSS attacks.

So my question is: are you aware of this, and are you planning to update your JS code?
Thanks

+ 1 we also have this issue. 
We value the functionality that Calendly provides and hope to continue using it without compromising our application's security. Your prompt response and any guidance on how to proceed securely would be greatly appreciated.

Thank you for your attention to this matter.

Best regards

Y

Great then, if no one at calendly cares about the security of their users, we’ll start looking for another solution for replacing it 🤷

A
Rank
Userlevel 1

Hey @yhy_! 

 

There are a few different approaches to instead of using the unsafe-* directives:

  • Move the Calendly JS code to a file that you host instead of inlining it in the page
  • Allowing external scripts to be loaded with either a nonce or hash

Here are few resources:

Reply


Terms & ConditionsCookie Settings