Experience Cloud: Invalid CSP Source from Visual Remote Assistant Managed Package Placeholder Values

Cause

When you install a managed package such as Visual Remote Assistant into your org, the package automatically creates Content Security Policy (CSP) Trusted Site entries to enable its functionality. During installation, these entries are populated with placeholder tokens (e.g., `{imagebaseurl}`, `{recordingbaseurl}`) instead of resolved hostnames.

Browsers interpret these literal curly-brace tokens as invalid CSP sources and log console warnings. However, the browser also notes that these invalid sources "will be ignored" — meaning they do not block any page functionality or asset loading. The site continues to operate normally despite the console errors.

This is a known behavior when managed packages are installed without post-installation configuration of the CSP Trusted Sites.

Resolution

To eliminate the CSP console errors, replace the malformed placeholder entries with properly formatted Trusted URLs:

1. In Setup, navigate to **Security** → **CSP Trusted Sites**.
2. Review the list of Trusted Sites. Identify any entries that contain literal curly-brace placeholder syntax, such as `{imagebaseurl}.techsee.me` or `{recordingbaseurl}.techsee.me`.
3. For each malformed entry, note the domain name (e.g., `techsee.me`) and the CSP directive it applies to (e.g., `img-src`, `script-src`).
4. Delete or edit the placeholder entry. Replace it with a wildcard Trusted URL entry using the actual hostname — for example, `https://*.techsee.me` — to allow the managed package to load resources from that domain.
5. After updating the CSP Trusted Sites, republish your Experience Cloud site:
- Navigate to **Experience Cloud** → **Sites**.
- Select your site.
- Click **Publish**.
6. Clear your browser cache and reload the site. The console errors should no longer appear.

If you are actively using the managed package's functionality (e.g., Visual Remote Assistant for remote support), verify that the feature continues to work after republishing. The properly formatted Trusted URL entry ensures both CSP compliance and feature availability.

Note:

- Placeholder entries may reappear after package updates.** If the managed package is updated or reinstalled, it may regenerate the placeholder CSP entries. You may need to repeat this remediation after package updates.
- Wildcard entries are broad. Using `https://*.techsee.me` allows the managed package to load resources from any subdomain under `techsee.me`. If you require more restrictive CSP rules, consult the managed package vendor's documentation for the specific subdomains required.
- this does not address other CSP errors. If you see CSP errors from other sources (custom components, Visualforce pages, or other managed packages), those require separate investigation.