Guides

Prerequisites

Please review the following information before you begin installation of the NeuroID JavaScript in your website.

Suggest Edits

Considerations & Known Limitations

  • Flutter - NeuroID does not support applications developed using the Flutter framework.
  • HTML Field Identifiers NeuroID differentiates form fields in your web application based on how they are decorated in your application. NeuroID can utilize any existing property on your HTML elements, but at least one property must exist on each. Ideally, each field is uniquely recognizable and observable by NeuroID’s JavaScript library. If your website does not consistently decorate your form field elements, please reference our documentation for more information on adding HTML5 data attributes that NeuroID can utilize.
  • Shadow DOM, iframes, and DOM encapsulation frameworks Web frameworks that utilize inline frames (iframes), the Shadow DOM API, or other encapsulation measures may prohibit the NeuroID JavaScript library from observing user interactions with form fields on the page. If your website utilizes encapsulation, behavioral observation by NeuroID may be unavailable or incomplete if care is not taken in the implementation of our JavaScript. While in some cases, this is an insurmountable limitation, in other cases, additional advanced configuration is necessary to allow NeuroID’s data collection library to function.
    • iframes - You must run NeuroID’s JavaScript library from within the iframe that contains the fields from which NeuroID will capture behavior.
    • Shadow DOM - In web applications that leverage the attachShadow() method, there are two methods of encapsulation referred to as “open Shadow DOM” and “closed Shadow DOM,” which occur when you set the mode property to either open or closed when declaring the Shadow DOM. A recursive function may be used to capture behavior from elements enclosed within an open Shadow DOM. However, as the name suggests, elements enclosed within a closed Shadow DOM are inaccessible. Please contact NeuroID customer support for more information on collection from an open Shadow DOM before proceeding with your installation.
    • Angular - In some older versions of Angular we have noticed performance degradation due to the way Angular’s change detection works. To fix this, any commands to the NeuroID library should be called from within the `runOutsideAngular` method which enables the NeuroID functions to run outside of the Angular zone. This may be required if your application is constructed with Angular version 8 or older.
  • Salesforce Lightning Web Components (LWC) The Salesforce LWC development framework has functions that disable event propagation to other components which stops events from being captured by NeuroID’s JavaScript. If your application is developed with this framework, an additional function will need to be added to the NeuroID JavaScript snippet which overrides the default stopPropagation behavior in order to add listeners for page events and target changes. Please contact NeuroID customer support for more information before proceeding with your installation.

Domain Safelisting

To integrate with NeuroID services, your application must allow connections to the NeuroID domains required by your implementation.

NeuroID services are hosted under the following domains:

  • https://*.neuro-id.com
  • https://*.neuroid.cloud

Common production endpoints include:

EndpointPurpose
https://scripts.neuro-id.comHosts NeuroID JavaScript assets
https://edge.neuroid.cloudRegional behavioral data collection
https://receiver.neuroid.cloudBehavioral data collection
https://dn.neuroid.cloudDevice and network services
https://advanced.neuro-id.comLegacy device and network services
https://rc.dn.neuroid.cloudDevice and network services used primarily for testing

Regional data collection through edge.neuroid.cloud currently uses endpoints such as:

  • https://edge.neuroid.cloud/use2/c
  • https://edge.neuroid.cloud/usw2/c

Content Security Policy rules are applied to the origin, so the regional paths do not require separate CSP entries. Allowing https://edge.neuroid.cloud covers the regional collector paths assigned to your implementation.

Some NeuroID implementations may use additional NeuroID-hosted endpoints. For example, a proof-of-concept or customer-specific configuration may use a dedicated *.neuro-id.com hostname. Only explicitly allow these hostnames when they are part of your NeuroID configuration.

Content Security Policy (CSP)

Content Security Policy (CSP) restricts the locations from which a browser may load resources or establish connections. If your application uses a restrictive CSP, the directives that control NeuroID resources must allow the appropriate NeuroID domains.

Depending on the features enabled in your NeuroID implementation, the following directives may be required:

  • connect-src — behavioral data collection and other HTTP requests
  • script-src — NeuroID JavaScript assets
  • frame-src — frames used by applicable device and network functionality
  • img-src — image resources used by applicable device and network functionality
  • worker-src — Web Workers used by applicable device and network functionality

Recommended configuration

For customers that permit wildcard subdomains, we recommend allowing the NeuroID parent domains in each CSP directive that is explicitly restricted by your application:

Content-Security-Policy:
  default-src 'self';
  connect-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  script-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  frame-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  img-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  worker-src 'self' blob:;

The example is shown on multiple lines for readability. When configuring an HTTP response header, format the policy according to the requirements of your web server or CDN.

Customers using explicit host allowlists

If your organization does not permit wildcard CSP sources, add the NeuroID hosts required by your implementation to the applicable directives.

Regional data collection

Customers using the regional collection endpoint must allow edge.neuroid.cloud in connect-src:

Content-Security-Policy: connect-src 'self' https://edge.neuroid.cloud https://receiver.neuroid.cloud https://dn.neuroid.cloud https://advanced.neuro-id.com;

Both of the following regional collectors are covered by the single https://edge.neuroid.cloud CSP source:

https://edge.neuroid.cloud/use2/c
https://edge.neuroid.cloud/usw2/c

JavaScript assets

Customers with a restrictive script-src must allow the host from which their NeuroID JavaScript is served:

Content-Security-Policy: script-src 'self' https://scripts.neuro-id.com https://advanced.neuro-id.com;

If your NeuroID configuration serves JavaScript from the regional Edge endpoint, also allow edge.neuroid.cloud:

Content-Security-Policy: script-src 'self' https://scripts.neuro-id.com https://edge.neuroid.cloud https://advanced.neuro-id.com;

If your CSP explicitly defines script-src-elem, the NeuroID JavaScript host must also be permitted by that directive because script-src-elem controls external <script> elements when it is present.

For example:

Content-Security-Policy: script-src-elem 'self' https://scripts.neuro-id.com https://edge.neuroid.cloud https://advanced.neuro-id.com;

Only include edge.neuroid.cloud in the script directives when JavaScript assets are served from that endpoint.

Advanced and device/network functionality

Implementations using applicable device/network functionality may also need NeuroID sources in frame-src, img-src, and worker-src.

For example:

Content-Security-Policy:
  frame-src 'self' https://advanced.neuro-id.com https://dn.neuroid.cloud;
  img-src 'self' https://advanced.neuro-id.com https://dn.neuroid.cloud;
  worker-src 'self' blob:;

Using default-src

If your existing policy allows NeuroID wildcard domains through default-src, for example:

Content-Security-Policy: default-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;

no additional NeuroID source is required for a CSP directive that is not explicitly defined.

For example, if connect-src is absent, it can fall back to the sources permitted by default-src.

However, default-src does not add sources to a more-specific directive that is already present. If your policy explicitly defines connect-src, script-src, frame-src, img-src, or worker-src, you must ensure that the applicable NeuroID domains are also permitted by that directive.

For example, this policy would still block NeuroID connections:

Content-Security-Policy:
  default-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  connect-src 'self';

To allow NeuroID connections, update the explicit directive:

Content-Security-Policy:
  default-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;
  connect-src 'self' https://*.neuro-id.com https://*.neuroid.cloud;

Updated 15 days ago

What’s Next

Once you have completed review of the prerequisites, please proceed to installation of the NeuroID JavaScript.