Content-Security-Policy header, you need to allow the Foil SDK to load, execute WebAssembly, spawn inline workers, create probe iframes, and communicate with the Foil API.
Required directives
script-src
The SDK is loaded as an ESM module from the Foil CDN. It also contains an embedded WebAssembly module that requires 'wasm-unsafe-eval' to instantiate.
'wasm-unsafe-eval' is the standard keyword for allowing WebAssembly to compile without also allowing eval() and other string-to-code APIs. 'wasm-eval' isn’t a standard keyword, so use 'wasm-unsafe-eval'.connect-src
The SDK sends encrypted observation data and receives scoring results from the Foil API. It also opens a WebSocket for network identity cross-validation (VPN/proxy detection), and, for organizations with the network edge probe enabled, runs the probe against Foil’s probe zone.
worker-src
The SDK creates inline Web Workers from blob URLs for cross-thread environment validation and debugger detection.
frame-src
The SDK creates temporary hidden same-origin iframes for realm isolation probes, CSP bypass detection, and font measurement.
Full example
A minimal CSP that supports Foil alongside your own assets:Foil itself needs no
font-src - it measures font metrics in place and fetches no external fonts. Add font-src only for your own web fonts.