CSP: allowing form submissions to Typeform via Intercom integration

Hey @juliabuckley thanks for stopping by and sharing this, just wondering if maybe @mathio or @picsoung might know the answer 🤔

Hi @juliabuckley, I am sorry but I have no experience with this integration.

However I fount this CSP docs on form-action and it says some browser might block redirects after form submissions. Could this be the case? In case you are experiencing the issue in Chrome, can you please check with Firefox to rule this out?

This is the integration we are using: https://www.typeform.com/blog/news/intercom-integration/

I don’t believe it has to do with a redirect, because we are just loading the form and not sending the user out of our application at all, and the CSP warning is saying it is refusing to load the form. I tried in Safari and had the same issue there, unfortunately. It is super confusing because I believe I should just be able to add `intercom-integration.typeform` to the allowed source list in the form-action directive of the CSP and it should work.  So I guess I am just grasping t straws and hoping someone has advice 

Hi @juliabuckley Could you share the URL where you have Typeform/Intercom so we can take a look? I haven’t seen this either, but it might be helpful to see the form within Intercom live, if possible. 

Unfortunately you won’t be able to access the page without an account. But here is a screenshot of how we are using intercom in our application. When the user clicks on the “Get Started” button a form from typeform is supposed to load within this little intercom embed. What actually happens is it loads a blank white view.  Not sure if this is helpful or not?

This is what I see in the console:

I was able to resolve the issue by setting the form-action directive as follows:

'form-action': https://intercom-integration.typeform.com/intercom/ 'self'

For some reason leaving out the https:// was not successful

@mathio Thanks! Yes I clearly was messing that up, thanks for pointing out =)

I think using *.intercom-integration.typeform.com/ expects to be there another value separated by dot before - eg. something.intercom-integration.typeform.com/ which is not the case. Using value intercom-integration.typeform.com/ might work as well, but I dont think you need to support other than https protocol.

Happy to help. Sometimes all you need is a second pair of eyes 😃 Happens to everybody.