microsoft / microsoft/AdaptiveCards
[Designer] Adaptive Cards Editor samples are empty because of Content Seurity Policy
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2k
- Forks
- 595
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 1
Description
Problem Description
In the Developer Portal's Adaptive Cards Editor: https://dev.teams.microsoft.com/cards/new -- nothing loads in the Pick a sample as a starting point window, opening the Network trace, you will see hundreds of the following errors:
Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "font-src data: *.sharepointonline.com *.akamaihd.net *.microsoft.com"
Refused to connect to 'https://raw.githubusercontent.com/OfficeDev/Microsoft-Teams-Card-Samples/main/samples/catalog.json' because it violates the following Content Security Policy directive: "connect-src *.office.net *.microsoft.com *.office.com *.microsoftonline.com *.office365.com *.msecnd.net *.live.com"
15.4cfd06ca.chunk.js:2 Refused to connect to 'https://raw.githubusercontent.com/OfficeDev/Microsoft-Teams-Card-Samples/main/samples/catalog.json' because it violates the following Content Security Policy directive: "connect-src *.office.net *.microsoft.com *.office.com *.microsoftonline.com *.office365.com *.msecnd.net *.live.com minimavenautosuggestppe.search.windows.net minimavenautosuggest.search.windows.net blob:"
CSP FAIL
Card JSON
{
"N/A": "N/A"
}
Screenshot
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the Developer Portal's Adaptive Cards Editor at https://dev.teams.microsoft.com/cards/new and reproduce the empty sample window while reviewing the Network trace. Inspect the Content Security Policy violations for the font requests and the catalog.json fetch from raw.githubusercontent.com; done means the samples load without CSP errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100