Power Platform Community Forum Thread Details

Hi Team,

I’m currently working on a Power Pages portal where I’ve integrated Azure Maps along with a custom feature to download usage data as an Excel file.

While configuring Content Security Policy (CSP) using the HTTP/Content-Security-Policy site setting, I’m facing multiple issues related to blocked resources.

Issues I’m facing

1. Azure Maps Worker Issue

I’m getting the below error in the console:

Creating a worker from 'blob:...' violates the following Content Security Policy directive: "script-src ..."
Note that 'worker-src' was not explicitly set

2. Data URL Blocked

Another error I’m seeing:

Connecting to 'data:image/svg+xml;base64,...' violates the following Content Security Policy directive: "connect-src ..."

3. External Script (XLSX CDN) Blocked

Loading the script 'https://cdnjs.cloudflare.com/...' violates CSP

Current CSP Configuration

Here is the CSP value I’ve configured in Site Settings:

script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.powerapps.com https://*.powerpages.microsoft.com https://*.microsoftonline.com https://*.dynamics.com https://*.azureedge.net https://atlas.microsoft.com https://*.atlas.microsoft.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.powerapps.com https://*.powerpages.microsoft.com https://*.azureedge.net https://atlas.microsoft.com https://*.atlas.microsoft.com; img-src 'self' data: blob: https://*.powerapps.com https://*.powerpages.microsoft.com https://*.azureedge.net https://atlas.microsoft.com https://*.atlas.microsoft.com; connect-src 'self' https://*.powerapps.com https://*.powerpages.microsoft.com https://*.microsoft.com https://*.dynamics.com https://atlas.microsoft.com https://*.atlas.microsoft.com; font-src 'self' https://*.azureedge.net https://atlas.microsoft.com https://*.atlas.microsoft.com;

Questions

What is the recommended CSP configuration for Azure Maps in Power Pages, especially regarding blob: and Web Workers?
Should worker-src be explicitly defined in Power Pages CSP?
Is it safe to include data: in connect-src for scenarios like SVG/base64 images?
Is there a best practice for handling external libraries like XLSX (CDN vs Web Files)?