Preliminary configuration

Before applying the Browser Agent and collecting data, you must complete the required pre-configuration.

Content Security Policy Settings

If your web application already has a Content Security Policy (CSP) configured, you must add the following items:

• The CDN URL of the Browser Agent

• The URL of the collection server used to transmit collected data

Additionally, to enable efficient data transmission by the Browser Agent, you must add CSP options related to Web Workers.

Directive	Source	Description
script-src, script-src-elem	unsafe-inline	Install the browser agent by using an inline script.
script-src, script-src-elem	https://repo.whatap-browser-agent.io/rum/prod/	Browser agent CDN domain
connect-src	https://rum-ap-northeast-2.whatap-browser-agent.io	Domain for transmission of collected data
worker-src, child-src	blob:	Web worker-related CSP options for efficient data transfer by the browser agent (recommended)

Timing-Allow-Origin Setting

On servers where CORS is applied, most resource timing attributes are returned as 0. To allow the Browser Agent to collect resource attribute values, the server must return the Timing-Allow-Origin HTTP response header.

How to configure

If you have control over the server that provides the resources, add the header to each response and specify all domains that are allowed to access the attributes (the domain of the website where the Browser Agent is applied).

• Example 1. Resource timing data is provided from all sources.

  Timing-Allow-Origin: *

• Example 2. Resource timing data is provided only in the domain of the web application to which the browser agent is applied.

  Timing-Allow-Origin: www.site.com