SharePoint / SharePoint/sp-dev-docs

CSP - installing webpart from Site Collection app catalog or Tenant app catalog in classic experience does't populate Trusted script sources with external links

Open
#10,524 2 comments 0 reactions 1 assignee View on GitHub

@jansenbe is already working on this.

Since Dec 11, 2025.

area:spfx
Dominant language
PowerShell
Stars
1.4k
Forks
1.1k
Avg merge
4d 12h
Merged PRs (30d)
12

Description

What type of issue is this?

Question

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Target SharePoint environment

SharePoint Online

What browser(s) / client(s) have you tested
  • 💥 Internet Explorer
  • 💥 Microsoft Edge
  • 💥 Google Chrome
  • 💥 FireFox
  • 💥 Safari
  • mobile (iOS/iPadOS)
  • mobile (Android)
  • not applicable
  • other (enter in the "Additional environment details" area below)
Additional environment details
  • SPFx version: 1.18
Issue description

Based on the CSP documentation, external files added to the externals section in ./config/config.json should be automatically pulled and added to the Trusted Script Sources list. I tested this, and it works as expected when using the Tenant App Catalog in modern view. However, when using the classic view, our CDN source is listed during installation, but the Trusted Script Sources list is not automatically updated.
Is there any chance this will be fixed or updated?

I also tried adding an app with entries in the externals section to the Site Collection App Catalog. The behavior was similar to what we observed with the Tenant App Catalog in classic mode: CDN links were listed during installation but were not automatically added to the Trusted Script Sources list.
What behavior should we expect in the case of the Site Collection App Catalog?

I am asking these questions as we are preparing for March, when CSP will become mandatory.
@jansenbe

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.