Velaro chat appears on your page as a small framed window (an iframe) that loads from a Velaro address. Security teams often ask three things about that: does it open you to clickjacking, does it depend on the Referer header, and will it run on a locked-down portal or CRM-hosted page. This article answers each one. For the list of addresses to allow, see Content Security Policy for Velaro Chat and Velaro Messaging and Content Security Policy (CSP) and Velaro.

Does the chat window create a clickjacking risk?

No. Clickjacking is when a hostile page hides a real application inside a frame and tricks someone into clicking it. Velaro protects against that in two ways:

• Every Velaro administration and application page tells the browser to refuse to be framed by any other site, so nobody can wrap them.
• The chat window is the one page that is meant to be framed, because it has to appear on your website. It shows only the visitor's own conversation. It has no administrator controls, no settings and no account actions, so there is nothing sensitive to trick a visitor into clicking.

Do I need to change my own framing headers?

No. Your page's own X-Frame-Options or frame-ancestors setting controls who may frame your page. It does not affect the Velaro chat window that your page frames. Keep your clickjacking protection exactly as it is.

What your policy does need is permission for the page to load the Velaro frame. Allow https://*.velaro.com in frame-src, together with script-src, connect-src and wss://*.velaro.com as listed in the articles above.

Does chat depend on the Referer header?

No. Velaro does not require, check or restrict by the Referer header, and there is no setting to turn on. The chat window loads for any page where you have installed your snippet.

Velaro uses the page address to show your team which page the visitor was on. The widget passes that address itself, so it still appears if your site sets Referrer-Policy: no-referrer or same-origin. The Velaro chat window sends strict-origin-when-cross-origin, which shares only the site name when a visitor follows a link out of chat.

Will it run inside a portal, CRM-hosted site or other sandboxed page?

Yes, in the usual setup. Three things decide it:

1. Trusted addresses. Add the Velaro entries to your platform's trusted-site or CSP list, with the script, frame and connection directives turned on. Chat stays blocked until all three are allowed.
2. Where the snippet goes. Put the Velaro snippet in the page head or a plain markup area, not inside a component that runs in a sandbox. Sandboxed components can stop a script from adding a frame to the page.
3. Camera and microphone. If your page sets a Permissions-Policy header, allow microphone and camera for https://*.velaro.com only if you use voice or video in chat.

How to confirm it works

Open your page in a private window, start a chat, and send a message. If the window does not appear, open the browser developer tools and look in the Console for a message that starts with Refused to frame, Refused to load the script or Refused to connect. The address named in that message is the one to add to your trusted list. Send it to Velaro support and we will confirm it with you.