Search code examples
azurecontent-security-policyazure-api-managementapim

APIM Management Content Security Policy Settings are not working as expected

I have APIM management with lot of APIs are imported and working. I published APIM developer portal with content security policy settings to allow only trusted resources. Since then I am unable to execute any APIs from developer portal which I am able to do it previously with Disabled CSP settings.

I tried different options but still getting blocked. I publish every time I change settings. Can some one help me in this

content-src 'self' https://contoso-apim.developer.azure-api.net

connect-src 'self';

enter image description here

From web browser, console log: enter image description here

enter image description here

Solution

  • I have Enabled Content Security Policy and have added the below lines in allowed resources Hostname.

    script-src 'self' https://****.developer.azure-api.net https://*****.azure-api.net 'unsafe-inline' 'unsafe-eval';

    enter image description here

    Post making the changes, I have published the developer portal. Then I am testing the Echo API using APIM developer portal and got the expected response.

    enter image description here