Getting Refused to connect to X because it violates the following Content Security Policy directive

[LasseL]

Dear community,

On a custom visual I am trying use a http post request by fetch to a logic app endpoint, and getting following error from the Console:

Refused to connect to 'https://xxx.logic.azure.com/xxx' because it violates the following Content Security Policy directive: "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

Following is the code from the react component of the visual:

    handleClick = () => {

        fetch('https://xxx.logic.azure.com:443/xxx', {  

        method: 'POST',

        mode: 'cors',

        body: JSON.stringify({"Data": {"Text1": "Test5", "Text2": "Test6"}}) // body data type must match "Content-Type" header

       })

I have read up on CSP and best I could find was: https://learn.microsoft.com/en-us/power-bi/developer/visuals/capabilities#privileges-define-the-spec...

For which reason I have tried to add to capabiltities.json the following:

     "privileges": [

        {

            "name": "WebAccess",

            "essential": true,

            "parameters": [ "https://prod-23.northeurope.logic.azure.com/", "https://*.logic.azure.com/", "https://prod-23.northeurope.logic.azure.com:443/", "*.logic.azure.com:443/" ]

        },

        {

            "name": "ExportContent",

            "essential": true

        }

    ]

}

Anyone got some ideas? Is it at all possible to do http request from a visual or has it been entirely blocked out by MS on the Power BI service?

Best regards and thanks

[pbn]

You got a 200 back. That's great.
So what exactly is your challenge?

The only think to do is to set the whitelisted web-urls in capabilities.json "privileges". Your own servers and all of the microsoft services as well.

[LasseMr]

Hi @pbn ,

The 200 I got back was a test with another visual from appsource, demonstrating that it is indeed possible to use fetch requests within custom visuals and sandboxed iframe.

You are very right, it was just a question of getting the privileges set right it terms of whitelisting, when I got the servers in the requests went straight through!

Thanks, I do not seem to find an actual answer that I can accept from you, can you provide one? 😉

Have a great day.

[pbn]

I really want to help you if I can. However, I don't understand your question. Where is your knowledge gap?