Refused to connect to '......' because it violates the following Content Security Policy directive

[luojiandanPBI]

hello everyone,

I need your help.

I use jQuery.js to get an *.json file,like this:

$.get("https://echarts.apache.org/examples/data/asset/geo/USA.json",
  function (json) {
     console.log('JSON Data:',json);
  }
);

and I get error message in Web Console:

jquery.js:10099 Refused to connect to 'https://echarts.apache.org/examples/data/asset/geo/USA.json' because it violates the following Content Security Policy directive: "default-src https://app.powerbi.cn data: blob: 'unsafe-inline' 'unsafe-eval'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

 

How can i do ? 

Thank you very much 

Best regards

[dm-p · Accepted solution]

Hi @luojiandanPBI,

You will need to amend your privileges in your visual capabilities to allow web access from within the visual. Setting the domain you need should suffice, e.g.:

{
  ...
  "privileges": [
    {
      "name": "WebAccess",
      "essential": true,
      "parameters": [ "https://echarts.apache.org" ]
    }
  ],
  ...
}

This may not be exactly right but should help you move forward.

Note that the endpoint may have restrictions on accessing sandboxed iframes (which is how custom visuals are hosted). If this is the case, then you will need to check with the site owner if they can change their cross-domain policies (but bear in mind that site owners are usually reluctant to do this).

Regards,

Daniel

[dm-p · Accepted solution]

Hi @luojiandanPBI,

You will need to amend your privileges in your visual capabilities to allow web access from within the visual. Setting the domain you need should suffice, e.g.:

{
  ...
  "privileges": [
    {
      "name": "WebAccess",
      "essential": true,
      "parameters": [ "https://echarts.apache.org" ]
    }
  ],
  ...
}

This may not be exactly right but should help you move forward.

Note that the endpoint may have restrictions on accessing sandboxed iframes (which is how custom visuals are hosted). If this is the case, then you will need to check with the site owner if they can change their cross-domain policies (but bear in mind that site owners are usually reluctant to do this).

Regards,

Daniel

[luojiandanPBI · Accepted solution]

Hi,Daniel,you are right.

github is ok.

"https://*.githubusercontent.com"

Thanks again.

[Brayancito2023]

Do you prove chatgtp?

[luojiandanPBI]

thanks for reply.

I try:

but i don't know how to set 'connect-src' in my files.