Violation in Content Security Policy when making a request to a alternative app backend

[ttschuemp]

I'm currently exploring the implementation of a new feature for the Redash app using an alternative backend. While attempting to make a request from the Redash frontend, I encountered the following error:

Refused to connect to 'https://app-backend.lbe3454tvs.azurewebsites.net/test' because it violates the document's Content Security Policy.

Interestingly, testing this API with Postman yielded successful results, and connecting to it from any other frontend also worked seamlessly. Hence, I suspect there might be a specific handling of Content Security Policy (CSP) within the Redash app that is causing this issue. Could you provide insights into how CSP is managed in the Redash app?

[gaecoli]

CONTENT_SECURITY_POLICY = os.environ.get(
"REDASH_CONTENT_SECURITY_POLICY",
"default-src 'self' ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' ; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-ancestors 'none'; frame-src redash.io;",
)

[gaecoli]

I'm currently exploring the implementation of a new feature for the Redash app using an alternative backend. While attempting to make a request from the Redash frontend, I encountered the following error:

Refused to connect to 'https://app-backend.lbe3454tvs.azurewebsites.net/test' because it violates the document's Content Security Policy.

Interestingly, testing this API with Postman yielded successful results, and connecting to it from any other frontend also worked seamlessly. Hence, I suspect there might be a specific handling of Content Security Policy (CSP) within the Redash app that is causing this issue. Could you provide insights into how CSP is managed in the Redash app?

redash/redash/settings/__init__.py

Line 114 in cd03da3

CONTENT_SECURITY_POLICY = os.environ.get(

You have to set you request url in REDASH_CONTENT_SECURITY_POLICY

[gaecoli]

This default config is "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; font-src 'self' data:; img-src 'self' http: https: data: blob:; object-src 'none'; frame-ancestors 'none'; frame-src redash.io;",