Getting Refused to load Scripts Error while running custom visual in chrome.

[MonikaGole]

I am loading a external script in power bi custom visual. 

powerbi-visuals-tools version - 4.2.1

Getting following error while running custom visual in developer mode in chrome: 

Refused to load the script 'https://developer.api.autodesk.com/modelderivative/v2/viewers/7.*/viewer3D.js' because it violates the following Content Security Policy directive: "default-src https://app.powerbi.com data: blob: 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.

[MonikaGole]

Thanks for the solution.

I have tried to set the CSP directive in pbiviz.json file.

Below is my pbiviz.json file :

{

    "visual": {

        "name": "sampleforgeViewervisual",

        "displayName": "sample_forgeViewer_visual",

        "guid": "sampleforgeViewervisualFE35C237FC27484483545CAFECAFA769",

        "visualClassName": "Visual",

        "version": "1.0.0",

        "description": "",

        "supportUrl": "",

        "gitHubUrl": "",

        "contentSecurityPolicy": "default-src https://app.powerbi.com data: blob: 'unsafe-inline' 'unsafe-eval' https://developer.api.autodesk.com"

    },

    "apiVersion": "5.1.0",

    "author": {

        "name": "",

        "email": ""

    },

    "assets": {

        "icon": "assets/icon.png"

    },

    "externalJS": null,

    "style": "style/visual.less",

    "capabilities": "capabilities.json",

    "dependencies": null,

    "stringResources": []

}

But this is not working.

Could you please tell me where to or how to set CSP directive while creating custom visual?

I am running the visual in developer mode.

[MonikaGole]

I am able to solve this issue by adding privileges setting that allowing access to external resources.

Example :

{ "name": "WebAccess", "essential": true, "parameters": [ "https://*.microsoft.com", "http://example.com" ] }

[Adamboer]

This error occurs because the script you are trying to load violates the Content Security Policy (CSP) of Power BI, which restricts the types of content that can be loaded into a visual. The CSP directive "default-src https://app.powerbi.com data: blob: 'unsafe-inline' 'unsafe-eval'" specifies that only scripts from the Power BI website, data URIs, and inline scripts are allowed. The external script you are trying to load does not meet this criteria.

To resolve this issue, you can modify the CSP directive to allow the external script to be loaded. You can do this by adding the domain of the external script to the "default-src" directive. For example, if the domain of the external script is "example.com", you can modify the directive to "default-src https://app.powerbi.com data: blob: 'unsafe-inline' 'unsafe-eval' example.com".

Keep in mind that modifying the CSP directive can pose a security risk, so you should only add domains that you trust.