Facebook Chat blocked by Safari (Content Security Policy issue)

We have deployed a Facebook Messenger chatbot to https:///sutterhome.com. It works on all browsers, except for Safari (macos and ios). The console outputs this error:

"Refused to load <facebook origin url> because it does not appear in the frame-ancestors directive of the Content Security Policy."

We are using the js code generated by Facebook for Messenger integration.

We have set the frame-ancestors parameter of the CSP to include facebook.com.

I have gone through every related post on StackOverflow and scoured the web and tried numerous permutations of the CSP and ensured that pertinent URLs have been whitelisted in the Facebook app and Messenger settings.

Is there a specific Referrer-Policy setting for Safari that will enable this connection to Facebook?

Has anyone had trouble with Facebook and Safari recently?

The bot was previously working in Safari. I don't know when the change occurred as it sat in limbo for months waiting for legal to sign off.

Any help is appreciated.


Answered by ddolan in 635565022
This is happening because the Prevent Cross-Site Tracking setting is on by default. It must be disabled for the Facebook script to load.
Accepted Answer
This is happening because the Prevent Cross-Site Tracking setting is on by default. It must be disabled for the Facebook script to load.
Facebook Chat blocked by Safari (Content Security Policy issue)
 
 
Q