SharePoint / SharePoint/sp-dev-docs
CSP - installing webpart from Site Collection app catalog or Tenant app catalog in classic experience does't populate Trusted script sources with external links
@jansenbe is already working on this.
Since Dec 11, 2025.
- Dominant language
- PowerShell
- Stars
- 1.4k
- Forks
- 1.1k
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 12
Description
What type of issue is this?
Question
What SharePoint development model, framework, SDK or API is this about?
💥 SharePoint Framework
Target SharePoint environment
SharePoint Online
What browser(s) / client(s) have you tested
- 💥 Internet Explorer
- 💥 Microsoft Edge
- 💥 Google Chrome
- 💥 FireFox
- 💥 Safari
- mobile (iOS/iPadOS)
- mobile (Android)
- not applicable
- other (enter in the "Additional environment details" area below)
Additional environment details
- SPFx version: 1.18
Issue description
Based on the CSP documentation, external files added to the externals section in ./config/config.json should be automatically pulled and added to the Trusted Script Sources list. I tested this, and it works as expected when using the Tenant App Catalog in modern view. However, when using the classic view, our CDN source is listed during installation, but the Trusted Script Sources list is not automatically updated.
Is there any chance this will be fixed or updated?
I also tried adding an app with entries in the externals section to the Site Collection App Catalog. The behavior was similar to what we observed with the Tenant App Catalog in classic mode: CDN links were listed during installation but were not automatically added to the Trusted Script Sources list.
What behavior should we expect in the case of the Site Collection App Catalog?
I am asking these questions as we are preparing for March, when CSP will become mandatory.
@jansenbe
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.