Forum Discussion
How to configure Content Security Policy for Power BI Report Server
We are using Power BI Report Server version 15.0.1116.121 (September 2024) and have embedded several reports within our web application UI.
Issue: In our web application, we have set up the following Content Security Policy (CSP):
With this CSP configuration, the Power BI reports are no longer rendering, and the browser console displays the following errors:
- Refused to execute inline script because it violates the Content Security Policy directive.
- EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the Content Security Policy directive.
To resolve this, we would need to add 'unsafe-inline' and 'unsafe-eval' to the CSP header, but this compromises security best practices. We are seeking your assistance to configure the use of a nonce or hash for the script to address this issue securely.
For adding 'unsafe-inline' and 'unsafe-eval' to Content Security Policy (CSP) while maintaining security, we can use a nonce (a random token) or hash-based approach. Is it supported in Power BI report server and how to configure it?
2 Replies
Hi, JedHuynh
There is no direct documentation on how to configure nonce or hash based CSPs for Power BI Reporting Server, but you can refer to this official documentation which I hope will help you:
Content security policy - Power Platform | Microsoft Learn
You may also want to refer to this documentation, which has some simple examples that will hopefully help you:
Content Security Policy - OWASP Cheat Sheet Series
I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.
Best Regards,
Fen Ling,
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.Hi Anonymous
According to the Content security policy - Power Platform | Microsoft Learn, I should be able to find the specified settings. However, I couldn't locate these configurations within our Power BI server setup.
In my Power BI server setup, I only see two configuration pages, but neither contains the settings mentioned in the documentation you provided.
Does the document apply to Power BI Report Server?
