microsoftgraph / microsoftgraph/microsoft-graph-explorer-v4
Content Security Policy directive blocks with Zscaler accessing Graph Explorer
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 260
- Forks
- 110
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
When using the Microsoft graph explorer to run API calls, the calls are running in the background fine, however, the visual display of Request Body and Response preview do not show anything and just show as loading. Looking into DevTools, the following error is flagging
InstrumentHooks.js:90 Connecting to 'https://eastus-8.in.applicationinsights.azure.com/v2/track' violates the following Content Security Policy directive: "connect-src https://dc.services.visualstudio.com https://browser.events.data.microsoft.com https://web.vortex.data.microsoft.com *.clarity.ms https://browser.pipe.aria.microsoft.com https://res.public.onecdn.static.microsoft https://res.df.onecdn.static.microsoft https://cdn.graph.office.net https://consentreceiverfd-prod.azurefd.net https://login.microsoftonline.com https://login.live.com https://www.microsoft.com https://statics.teams.microsoft.com https://controls.account.microsoft.com:44308 https://amcdn.msftauth.net http://amcdn.msauth.net/ https://mem.gfx.ms https://developer.microsoft.com https://graphprodblobstorage-secondary.blob.core.windows.net https://cdn.graph.office.net https://graphexplorerapi.azurewebsites.net https://login.microsoftonline.com https://graph.office.net https://graph.microsoft.com https://browser.pipe.aria.microsoft.com https://clients.config.office.net https://petrol.office.microsoft.com https://mgt.dev https://templates.adaptivecards.io/ https://graphexplorerapi-staging.azurewebsites.net/ https://canary.graph.microsoft.com/ https://default.exp-tas.com https://devxapi-func-prod-eastus.azurewebsites.net https://graphexplorer.microsoft.com". The action has been blocked.
To Reproduce
Steps to reproduce the behavior:
- Go to 'https://developer.microsoft.com/en-us/graph/graph-explorer'
- Open DevTool
- Click on 'Run query'
- Change to Console in DevTools
-
- See error violates the following Content Security Policy directive: "connect-src
Screenshots
Desktop (please complete the following information):
- OS: Windows 11
- Browser Edge
- Version 147.0.3912.37
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open the Graph Explorer URL and reproduce the issue by running a query while watching the DevTools console. Inspect the Content Security Policy connect-src configuration and the blocked Application Insights endpoint; done means the Request Body and Response preview render and the reported CSP violation no longer occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100