How to configure Content Security Policy for Power BI Report Server
We are using Power BI Report Server version 15.0.1116.121 (September 2024) and have embedded several reports within our web application UI. Issue: In our web application, we have set up the following Content Security Policy (CSP): Content-Security-Policy: script-src 'self' https://www.google.com https://www.gstatic.com *.prod.ourcompany.net; object-src 'self' *.prod.ourcompany.net d1qg0coei5ayz5.cloudfront.net; worker-src blob: *.prod.ourcompany.net; With this CSP configuration, the Power BI reports are no longer rendering, and the browser console displays the following errors: Refused to execute inline script because it violates the Content Security Policy directive. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the Content Security Policy directive. To resolve this, we would need to add 'unsafe-inline' and 'unsafe-eval' to the CSP header, but this compromises security best practices. We are seeking your assistance to configure the use of a nonce or hash for the script to address this issue securely. For adding 'unsafe-inline' and 'unsafe-eval' to Content Security Policy (CSP) while maintaining security, we can use a nonce (a random token) or hash-based approach. Is it supported in Power BI report server and how to configure it?