Content-Security-Policy with azure communication services

Question

Content-Security-Policy with azure communication services

Ralph van der Neut 6

Everytime i start a ACS call using the calling js library.
I get the following error:

Refused to connect to 'wss://trouter-azsc-euno-0-a.trouter.skype.com/socket.io/1/websocket/<dynamic info>' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval' https: data: <other url>

I tried adding "wss://trouter-azsc-euno-0-a.trouter.skype.com/socket.io/1/websocket" to "Content-Security-Policy" http response header, but that doesn't work. Because the url is dynamic on each call. I can't use a wildcard? What should i set in the Content Security Policy to make the error dissapear?

Grmacjon-MSFT 19,301 Reputation points Moderator

2021-11-16T20:32:03.043+00:00

Hi @Ralph van der Neut ,

Thanks for bringing this to our attention. When did you start noticing this issue? We are checking internally with the engineering team to see what may be causing this issue. We appreciate your patience.

Thanks,
Grace
.
Ralph van der Neut 6 Reputation points

2021-11-19T12:51:33.39+00:00

I started noticing this when we deployed it to our vm in azure.
There are multiple security features running there for minimizing the cross site scripting attacks.
But it needs a url or ws path to the external site to allow it access.
However the ACS call still works, but it looks like it still does something under the hood that needs to be allowed.

Your answer

Grmacjon-MSFT 19,301 Reputation points Moderator

2021-11-16T20:32:03.043+00:00

Hi @Ralph van der Neut ,

Thanks for bringing this to our attention. When did you start noticing this issue? We are checking internally with the engineering team to see what may be causing this issue. We appreciate your patience.

Thanks,
Grace
.
Ralph van der Neut 6 Reputation points

2021-11-19T12:51:33.39+00:00

I started noticing this when we deployed it to our vm in azure.
There are multiple security features running there for minimizing the cross site scripting attacks.
But it needs a url or ws path to the external site to allow it access.
However the ACS call still works, but it looks like it still does something under the hood that needs to be allowed.

Share via

Content-Security-Policy with azure communication services

Your answer