microsoftgraph / microsoftgraph/microsoft-graph-explorer-v4

Content Security Policy directive blocks with Zscaler accessing Graph Explorer

Open
#4,026 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Triaged-Unassigned
Dominant language
TypeScript
Stars
260
Forks
110
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
When using the Microsoft graph explorer to run API calls, the calls are running in the background fine, however, the visual display of Request Body and Response preview do not show anything and just show as loading. Looking into DevTools, the following error is flagging

InstrumentHooks.js:90 Connecting to 'https://eastus-8.in.applicationinsights.azure.com/v2/track' violates the following Content Security Policy directive: "connect-src https://dc.services.visualstudio.com https://browser.events.data.microsoft.com https://web.vortex.data.microsoft.com *.clarity.ms https://browser.pipe.aria.microsoft.com https://res.public.onecdn.static.microsoft https://res.df.onecdn.static.microsoft https://cdn.graph.office.net https://consentreceiverfd-prod.azurefd.net https://login.microsoftonline.com https://login.live.com https://www.microsoft.com https://statics.teams.microsoft.com https://controls.account.microsoft.com:44308 https://amcdn.msftauth.net http://amcdn.msauth.net/ https://mem.gfx.ms https://developer.microsoft.com https://graphprodblobstorage-secondary.blob.core.windows.net https://cdn.graph.office.net https://graphexplorerapi.azurewebsites.net https://login.microsoftonline.com https://graph.office.net https://graph.microsoft.com https://browser.pipe.aria.microsoft.com https://clients.config.office.net https://petrol.office.microsoft.com https://mgt.dev https://templates.adaptivecards.io/ https://graphexplorerapi-staging.azurewebsites.net/ https://canary.graph.microsoft.com/ https://default.exp-tas.com https://devxapi-func-prod-eastus.azurewebsites.net https://graphexplorer.microsoft.com". The action has been blocked.

To Reproduce
Steps to reproduce the behavior:

  1. Go to 'https://developer.microsoft.com/en-us/graph/graph-explorer'
  2. Open DevTool
  3. Click on 'Run query'
  4. Change to Console in DevTools
    1. See error violates the following Content Security Policy directive: "connect-src

Screenshots

Image

Desktop (please complete the following information):

  • OS: Windows 11
  • Browser Edge
  • Version 147.0.3912.37

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open the Graph Explorer URL and reproduce the issue by running a query while watching the DevTools console. Inspect the Content Security Policy connect-src configuration and the blocked Application Insights endpoint; done means the Request Body and Response preview render and the reported CSP violation no longer occurs.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.