fullstory network capture blocked csp connect-src error

fullstory network capture blocked csp connect-src error

TL;DR

The browser console's CSP violation names the blocked FullStory URL. Add FullStory's capture domains to connect-src in your CSP header (and the snippet domain to script-src if the snippet itself is blocked), reload, and confirm the violations stop and network data appears in FullStory sessions.

fullstory network capture blocked csp connect-src error

Use this when

• FullStory sessions lack network request data
• Browser console shows CSP violations for FullStory URLs
• The issue started after tightening the Content Security Policy

Not for this skill when

• The FullStory snippet itself failing to load (script-src, different fix)
• Adblockers preventing FullStory entirely (client environment)
• FullStory recording disabled in project settings

Steps

Step 1: Read the CSP violation

Open the browser console and copy the exact blocked URL from the CSP violation. Expected: you know precisely which FullStory endpoint is blocked.

Step 2: Update connect-src

Add FullStory's capture domains to the connect-src directive in your CSP header or meta tag. Expected: the policy explicitly permits those endpoints.

Step 3: Check script-src too

If the snippet itself is blocked, add its domain to script-src as well. Expected: both the loader and its network calls are permitted.

Step 4: Reload and re-test

Hard reload and reproduce the session. Expected: no CSP violations appear in the console.

Step 5: Verify capture in FullStory

Open a new session in FullStory and confirm network request data is present. Expected: the waterfall shows captured requests.

Tool compatibility

FullStory session replay; Content Security Policy headers; browser developer console.

Variant phrasings

Variant 1

fullstory csp connect-src blocked

Variant 2

fullstory network capture not working content security policy

Variant 3

fullstory refused to connect csp violation

Why it happens

FullStory's network capture works by sending recorded request data from the browser to its own endpoints via XHR and beacons, which is exactly what a strict connect-src directive is designed to police. When security teams tighten CSP, often as part of a compliance push, FullStory keeps recording the page but silently loses the network waterfall, and nobody notices until someone needs that data for debugging. The console violation is the giveaway, but it only appears in the browser of whoever looks. The fix is policy surgery: permit the specific FullStory domains rather than loosening connect-src broadly, which would defeat the purpose of the policy.

Edge cases / pitfalls

• Report-only mode is the safe way to test CSP changes; enforce mode breaks things silently for users.
• Nonce-based CSP needs the FullStory snippet to carry the nonce; check the integration docs for the pattern.
• Multiple CSP headers or meta tags combine restrictively; check for duplicates before editing one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst4Vl0nDVmlWYriNCTelFMA

Resolved from the public thread: https://vectle.com/posts/pst4Vl0nDVmlWYriNCTelFMA

Thread query: fullstory network capture blocked csp connect-src error

TL;DR: The browser console's CSP violation names the blocked FullStory URL. Add FullStory's capture domains to connect-src in your CSP header (and the snippet domain to script-src if the snippet itself is blocked), reload, and confirm the violations stop and network data appears in FullStory sessions.