Skip to content

Update from code changes: drop Turnstile from widget CSP #7006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ethanpalm merged 1 commit into from
Aug 18, 2026
+0 −4
Merged

Update from code changes: drop Turnstile from widget CSP #7006

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion assistant/widget.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@

export const WidgetCodeBlock = ({ children, ...props }) => (
<CodeBlock {...props}>{children}</CodeBlock>
);

Check warning on line 13 in assistant/widget.mdx

View check run for this annotation

Mintlify / Mintlify Validation (mintlify) - vale-spellcheck

assistant/widget.mdx#L13 

Use semicolons judiciously.

The [assistant](/assistant) answers questions on your Mintlify site. To embed the same capability on another site or web app, use the widget. The widget gives your users access to AI chat trained on your content, wherever they use your product. Embed it in your dashboard, marketing site, support portal, or elsewhere.

Expand Down Expand Up @@ -286,7 +286,7 @@

Conversation snapshots remain private to the widget. Each method resolves to `void`.

## Content Security Policy

Check warning on line 289 in assistant/widget.mdx

View check run for this annotation

Mintlify / Mintlify Validation (mintlify) - vale-spellcheck

assistant/widget.mdx#L289 

'Content Security Policy' should use sentence-style capitalization.

If your site uses a Content Security Policy, allow the origins required by your enabled widget features:

Expand All @@ -297,9 +297,8 @@
| `connect-src` | `https://api.mintlify.com` | Configuration, messages, and feedback |
| `connect-src` | `https://ph.mintlify.com` | Internal widget analytics |
| `font-src` | `https://widget.mintlify.com` | Optional bundled Inter font |
| `script-src`, `connect-src`, and `frame-src` | `https://challenges.cloudflare.com` | Turnstile bot protection |
| `script-src` | `https://js.hcaptcha.com` | hCaptcha bot protection |

Check warning on line 300 in assistant/widget.mdx

View check run for this annotation

Mintlify / Mintlify Validation (mintlify) - vale-spellcheck

assistant/widget.mdx#L300 

Use 'hCaptcha' instead of 'hcaptcha'.
| `connect-src` and `frame-src` | `https://*.hcaptcha.com` | hCaptcha bot protection |

Check warning on line 301 in assistant/widget.mdx

View check run for this annotation

Mintlify / Mintlify Validation (mintlify) - vale-spellcheck

assistant/widget.mdx#L301 

Use 'hCaptcha' instead of 'hcaptcha'.

A strict `script-src` policy must still authorize both the loader and initialization script. A strict `style-src` policy must authorize the nonce you pass to `init()`, which the widget copies to its injected style sheet. Passing `nonce` to `init()` propagates it only to resources the widget creates after initialization.

Expand Down
1 change: 0 additions & 1 deletion es/assistant/widget.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,6 @@ Si tu sitio usa una Content Security Policy, permite los orígenes requeridos po
| `connect-src` | `https://api.mintlify.com` | Configuración, mensajes y comentarios |
| `connect-src` | `https://ph.mintlify.com` | Analíticas internas del widget |
| `font-src` | `https://widget.mintlify.com` | Fuente Inter incluida opcional |
| `script-src`, `connect-src`, and `frame-src` | `https://challenges.cloudflare.com` | Protección contra bots Turnstile |
| `script-src` | `https://js.hcaptcha.com` | Protección contra bots hCaptcha |
| `connect-src` and `frame-src` | `https://*.hcaptcha.com` | Protección contra bots hCaptcha |

Expand Down
1 change: 0 additions & 1 deletion fr/assistant/widget.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,6 @@ Si votre site utilise une Content Security Policy, autorisez les origines requis
| `connect-src` | `https://api.mintlify.com` | Configuration, messages et commentaires |
| `connect-src` | `https://ph.mintlify.com` | Analytique interne du widget |
| `font-src` | `https://widget.mintlify.com` | Police Inter intégrée facultative |
| `script-src`, `connect-src`, and `frame-src` | `https://challenges.cloudflare.com` | Protection anti-bot Turnstile |
| `script-src` | `https://js.hcaptcha.com` | Protection anti-bot hCaptcha |
| `connect-src` and `frame-src` | `https://*.hcaptcha.com` | Protection anti-bot hCaptcha |

Expand Down
1 change: 0 additions & 1 deletion zh/assistant/widget.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,6 @@ hooks: {
| `connect-src` | `https://api.mintlify.com` | 配置、消息和反馈 |
| `connect-src` | `https://ph.mintlify.com` | 小组件内部分析 |
| `font-src` | `https://widget.mintlify.com` | 可选的内置 Inter 字体 |
| `script-src`, `connect-src`, and `frame-src` | `https://challenges.cloudflare.com` | Turnstile 机器人防护 |
| `script-src` | `https://js.hcaptcha.com` | hCaptcha 机器人防护 |
| `connect-src` and `frame-src` | `https://*.hcaptcha.com` | hCaptcha 机器人防护 |

Expand Down