Network and CSP

This page lists every host the collector contacts in each mode, and the Content Security Policy entries that allow them. Every host is run by you or by Octet.

Hosts by mode

Destination	Protocol	`full`	`lite`	`passive`
Your edge, for example `octet.example.com`	HTTPS POST to `/v1/signals`	Yes	Yes	Yes
Your edge	WebSocket (`wss://`) to `/v1/ws`	Yes	Yes	No
`lon1.octetproof.com`, `chs1.octetproof.com`, `sin1.octetproof.com`	HTTPS	Yes	No	No
`lon1.octetproof.com`, `chs1.octetproof.com`, `sin1.octetproof.com`	UDP 3478 (WebRTC)	Yes	Yes	No

In full and lite mode the collector contacts these three Octet hosts. They receive no cookies and no credentials.

Content Security Policy

The collector needs connect-src entries for your mode, and a worker-src entry in every mode. Add them to your existing policy.

full, the default:

connect-src 'self' https://octet.example.com wss://octet.example.com https://lon1.octetproof.com https://chs1.octetproof.com https://sin1.octetproof.com;

lite:

connect-src 'self' https://octet.example.com wss://octet.example.com;

passive:

connect-src 'self' https://octet.example.com;

Replace octet.example.com with your edge's hostname. List wss:// for your edge explicitly, even if the edge shares your page's origin, because some browsers don't treat 'self' as covering WebSockets.

In every mode the collector also starts a Web Worker from a blob: URL. Allow it for the best results:

worker-src blob:;

If the Worker is blocked, the collector carries on without it and never throws an error because of it. If your policy has no worker-src directive, browsers apply to workers the first of child-src, script-src and default-src that your policy sets. Adding worker-src replaces that rule for workers, so also list any sources your own workers use.

If you serve octet-collector.js from your own origin, script-src 'self' covers it. The collector needs no unsafe-eval.

The collector's check frame

From v1.8.0 the collector runs a short check in a hidden, sandboxed srcdoc frame with a small inline script, and removes the frame within a second. What your policy needs depends on how it allows scripts:

Your policy	What happens	What to do
No CSP, or `script-src` with `'unsafe-inline'`	The check runs	Nothing
`script-src` with a nonce, with or without `'strict-dynamic'`	The check needs your page's nonce	Pass it as `cspNonce`, especially if your page removes its nonced scripts after load
`script-src` with hashes only	The check is skipped quietly. The browser may send a CSP violation report	Add a nonce, or accept that the check is skipped
Trusted Types, with a `trusted-types` list	The policy `octet-collector` is refused once, then the check is skipped	Add `octet-collector` to `trusted-types`
`frame-src` or `child-src`	Not affected	Nothing

Without the nonce, the collector uses the nonce of a script already on the page. In every case nothing else changes: no error, no prompt, and the verdict still arrives.

WebRTC and firewalls

CSP does not control WebRTC. In full and lite mode the browser sends UDP packets to port 3478 on the three Octet network hosts. Corporate firewalls and some networks block outbound UDP. If yours might, allow outbound UDP 3478 to lon1.octetproof.com, chs1.octetproof.com and sin1.octetproof.com.

If a host is blocked

The collector still works. It leaves out any measurement it could not make, sends the rest to your edge, and never throws an error because of it. The verdict is weaker, so more masked sessions come back as none or low.

The one request that must succeed is the POST to your edge. If it is blocked, ready() and verify() reject, and no verdict is produced.

Your edge

Direction	Protocol and port	Peer
Inbound	TCP 443	Browsers
Outbound	TCP 443	`geo.octetproof.com`

Your backend

Direction	Protocol and port	Peer
Outbound	TCP 443	`geo.octetproof.com`, for challenges, verdicts and the key sets

If your backend can't reach geo.octetproof.com, see Get a challenge for requesting challenges through your edge.