# \#content-security-policy

**URL:** https://community.developer.atlassian.com/tag/content-security-policy/1227.md

[Latest](https://community.developer.atlassian.com/latest.md) · [Categories](https://community.developer.atlassian.com/categories.md) · [Tags](https://community.developer.atlassian.com/tags.md)

---

## [Rest API call for fetching teams](https://community.developer.atlassian.com/t/rest-api-call-for-fetching-teams/79521)

<div class="topic-metadata">

**Author:** [@SandeshRai](https://community.developer.atlassian.com/u/SandeshRai)\
**Replies:** 19\
**Last updated:** [February 12, 2026, 2:50pm UTC](https://community.developer.atlassian.com/t/rest-api-call-for-fetching-teams/79521 "2026-02-12T14:50:03Z")

</div>

I am trying to fetch the team details in my Forge App but I am always encountering errors. I wrote this code const organizationRes = await requestJira(\`/rest/api/3/organization\`); const organizationData = aw…

---

## [External Links in IFrames Do Not Open After Migrating to Forge (Confluence)](https://community.developer.atlassian.com/t/external-links-in-iframes-do-not-open-after-migrating-to-forge-confluence/98893)

<div class="topic-metadata">

**Author:** [@SamiBelHajHassine](https://community.developer.atlassian.com/u/SamiBelHajHassine)\
**Replies:** 3\
**Last updated:** [February 5, 2026, 9:00am UTC](https://community.developer.atlassian.com/t/external-links-in-iframes-do-not-open-after-migrating-to-forge-confluence/98893 "2026-02-05T09:00:30Z")

</div>

Hello, after moving my module to forge in atlassian confluence, Intercom usage had a problem, links inside don’t work (only using open new tab) so this is mainly because of the forge security layer.. As I think that popu…

---

## [Forge App fails on custom Jira domain with origin error (Message received from invalid origin)](https://community.developer.atlassian.com/t/forge-app-fails-on-custom-jira-domain-with-origin-error-message-received-from-invalid-origin/91743)

<div class="topic-metadata">

**Author:** [@AdrianWolf](https://community.developer.atlassian.com/u/AdrianWolf)\
**Replies:** 3\
**Last updated:** [January 15, 2026, 1:30pm UTC](https://community.developer.atlassian.com/t/forge-app-fails-on-custom-jira-domain-with-origin-error-message-received-from-invalid-origin/91743 "2026-01-15T13:30:33Z")

</div>

Hi Atlassian team and fellow developers, I’m running into a problem when trying to use my Forge app on a Jira Cloud instance that uses a custom domain. The app works perfectly on standard Atlassian instances, but fails …

---

## [Confluence Forge Custom UI: Handling iframe Embedding for Different Content Types — Whiteboards, Databases, and Smart Links Fail Due to CSP](https://community.developer.atlassian.com/t/confluence-forge-custom-ui-handling-iframe-embedding-for-different-content-types-whiteboards-databases-and-smart-links-fail-due-to-csp/98249)

<div class="topic-metadata">

**Author:** [@RamPrakashChauhan](https://community.developer.atlassian.com/u/RamPrakashChauhan)\
**Replies:** 0\
**Last updated:** [January 8, 2026, 10:54am UTC](https://community.developer.atlassian.com/t/confluence-forge-custom-ui-handling-iframe-embedding-for-different-content-types-whiteboards-databases-and-smart-links-fail-due-to-csp/98249 "2026-01-08T10:54:22Z")

</div>

Hello Atlassian Developer Community, I’m currently developing a Confluence macro using Forge Custom UI that allows users to search for various Confluence content types (Pages, LiveDocs, Whiteboards, Databases, Smart Lin…

---

## [How can we alter the CSP in the cloud version of JSM](https://community.developer.atlassian.com/t/how-can-we-alter-the-csp-in-the-cloud-version-of-jsm/95281)

<div class="topic-metadata">

**Author:** [@NCarmichael](https://community.developer.atlassian.com/u/NCarmichael)\
**Replies:** 0\
**Last updated:** [September 12, 2025, 8:27am UTC](https://community.developer.atlassian.com/t/how-can-we-alter-the-csp-in-the-cloud-version-of-jsm/95281 "2025-09-12T08:27:40Z")

</div>

We having an issue with the cloud version of JSM we are using , it is missing a declaration for cloudfront (the CDN Atlassian use) meaning some javescript and images are no loading. This is known issue with the hosted v…

---

## [New CSP warnings from \*.atl-paas.net](https://community.developer.atlassian.com/t/new-csp-warnings-from-atl-paas-net/92075)

<div class="topic-metadata">

**Author:** [@scottohara](https://community.developer.atlassian.com/u/scottohara)\
**Replies:** 6\
**Last updated:** [May 21, 2025, 7:57am UTC](https://community.developer.atlassian.com/t/new-csp-warnings-from-atl-paas-net/92075 "2025-05-21T07:57:03Z")

</div>

As per the Security requirement for cloud apps (and as a good citizen of the broader internet) all of our apps set a Content-Security-Policy header that includes https://connect-cdn.atl-paas.net as a trusted source for s…

---

## [Forge Content Security Policy for scripts unsafe-inline not working](https://community.developer.atlassian.com/t/forge-content-security-policy-for-scripts-unsafe-inline-not-working/57718)

<div class="topic-metadata">

**Author:** [@GavinBunney](https://community.developer.atlassian.com/u/GavinBunney)\
**Replies:** 6\
**Last updated:** [December 17, 2024, 12:14am UTC](https://community.developer.atlassian.com/t/forge-content-security-policy-for-scripts-unsafe-inline-not-working/57718 "2024-12-17T00:14:02Z")

</div>

For my forge application, I need to allow unsafe-inline for scripts. However, the Content-Security-Policy generated is including a hash, so does not allow inline scripts to be executed. Error from the browser console: i…

---

## [Error Unrecognized Content-Security-Policy directive 'navigate-to' in iframe](https://community.developer.atlassian.com/t/error-unrecognized-content-security-policy-directive-navigate-to-in-iframe/86467)

<div class="topic-metadata">

**Author:** [@cristian](https://community.developer.atlassian.com/u/cristian)\
**Replies:** 6\
**Last updated:** [December 5, 2024, 12:46am UTC](https://community.developer.atlassian.com/t/error-unrecognized-content-security-policy-directive-navigate-to-in-iframe/86467 "2024-12-05T00:46:10Z")

</div>

Hi, I’m creating a plugin for Jira cloud through Forge and I need to render an external iframe using a URL but I’m getting the error: Unrecognized Content-Security-Policy directive ‘navigate-to’. I think I have the nece…

---

## [Images from external source in CustomUI](https://community.developer.atlassian.com/t/images-from-external-source-in-customui/51434)

<div class="topic-metadata">

**Author:** [@DecreeLabs](https://community.developer.atlassian.com/u/DecreeLabs)\
**Replies:** 3\
**Last updated:** [September 11, 2024, 5:57pm UTC](https://community.developer.atlassian.com/t/images-from-external-source-in-customui/51434 "2024-09-11T17:57:16Z")

</div>

On the CustomUI module, I’d like to display from a source like \<img src="https://logo.clearbit.com/spotify.com?size=80"\> Adding the CSP images logo.clearbit.com does not seem to work and results in a CSP violation. Wh…

---

## [What CSPs to set on Atlassian Connect apps](https://community.developer.atlassian.com/t/what-csps-to-set-on-atlassian-connect-apps/80940)

<div class="topic-metadata">

**Author:** [@aragot](https://community.developer.atlassian.com/u/aragot)\
**Replies:** 4\
**Last updated:** [June 18, 2024, 12:57pm UTC](https://community.developer.atlassian.com/t/what-csps-to-set-on-atlassian-connect-apps/80940 "2024-06-18T12:57:50Z")

</div>

This is not a question. It’s a summary of the current understanding of the community about the HTTP headers for the Content Security Policy (As Murphy’s law says, the best way to have the correct answer is to post the wr…

---

## [Deprecation notice: Loading Connect stylesheets from CDN instead of inline](https://community.developer.atlassian.com/t/deprecation-notice-loading-connect-stylesheets-from-cdn-instead-of-inline/80010)

<div class="topic-metadata">

**Author:** [@SamLeatherdale](https://community.developer.atlassian.com/u/SamLeatherdale)\
**Replies:** 5\
**Last updated:** [May 29, 2024, 10:11am UTC](https://community.developer.atlassian.com/t/deprecation-notice-loading-connect-stylesheets-from-cdn-instead-of-inline/80010 "2024-05-29T10:11:22Z")

</div>

Update: This removal has now been actioned, see the removal notice here. Hi developer community, we just announced the deprecation of Atlassian Connect JS loading stylesheets via inline styles, to loading them from the …

---

## [CSP violation on data:](https://community.developer.atlassian.com/t/csp-violation-on-data/79441)

<div class="topic-metadata">

**Author:** [@Nowak](https://community.developer.atlassian.com/u/Nowak)\
**Replies:** 1\
**Last updated:** [May 6, 2024, 5:55am UTC](https://community.developer.atlassian.com/t/csp-violation-on-data/79441 "2024-05-06T05:55:12Z")

</div>

I’m getting error: Refused to connect to ‘data:image/png;charset=UTF-8;base64, base64String’ because it violates the following Content Security Policy directive: "connect-src ‘self’ https://api.atlassian.com/metal/inges…

---

## [Use basic fetch](https://community.developer.atlassian.com/t/use-basic-fetch/79467)

<div class="topic-metadata">

**Author:** [@Paul6](https://community.developer.atlassian.com/u/Paul6)\
**Replies:** 4\
**Last updated:** [April 29, 2024, 3:12am UTC](https://community.developer.atlassian.com/t/use-basic-fetch/79467 "2024-04-29T03:12:04Z")

</div>

useEffect(async () =\> { fetchData(); }, \[\]); const fetchData = async () =\> { try { const response = await fetch('https://api.npms.io/v2/search?q=react'); if (!response.ok) { throw new Error('…

---

## [Using a data uri in Forge](https://community.developer.atlassian.com/t/using-a-data-uri-in-forge/78063)

<div class="topic-metadata">

**Author:** [@BPB](https://community.developer.atlassian.com/u/BPB)\
**Replies:** 11\
**Last updated:** [April 9, 2024, 3:18am UTC](https://community.developer.atlassian.com/t/using-a-data-uri-in-forge/78063 "2024-04-09T03:18:07Z")

</div>

I get this error in my browser console when working with Forge Custom UI: Refused to connect to 'data:image/svg+xml;base64,\<STUFF\>' because it violates the document's Content Security Policy. I have tried all of the fo…

---

## [Unable to load Google Autocomplete script](https://community.developer.atlassian.com/t/unable-to-load-google-autocomplete-script/78132)

<div class="topic-metadata">

**Author:** [@GyorgyVARGA](https://community.developer.atlassian.com/u/GyorgyVARGA)\
**Replies:** 2\
**Last updated:** [March 11, 2024, 8:14am UTC](https://community.developer.atlassian.com/t/unable-to-load-google-autocomplete-script/78132 "2024-03-11T08:14:52Z")

</div>

Hi! When I installed this package to my custom ui react app: react-google-autocomplete - npm And reference the component like this in my react component: \<Autocomplete apiKey='abcd' onPlace…

---

## [Content-Security-Policy problem with Jira Issue Panel with Custom UI](https://community.developer.atlassian.com/t/content-security-policy-problem-with-jira-issue-panel-with-custom-ui/75376)

<div class="topic-metadata">

**Author:** [@axldpir](https://community.developer.atlassian.com/u/axldpir)\
**Replies:** 5\
**Last updated:** [March 1, 2024, 2:51pm UTC](https://community.developer.atlassian.com/t/content-security-policy-problem-with-jira-issue-panel-with-custom-ui/75376 "2024-03-01T14:51:14Z")

</div>

Hi, I have app with two modules, Jira Issue Panel and Jira Project settings page. When I open Jira Issue Panel in browser I get the following error in Developer console. all.js:51 Refused to load the stylesheet 'https:…

---

## [CSP issues with issue collector implemetation](https://community.developer.atlassian.com/t/csp-issues-with-issue-collector-implemetation/77307)

<div class="topic-metadata">

**Author:** [@kyleberkland](https://community.developer.atlassian.com/u/kyleberkland)\
**Replies:** 3\
**Last updated:** [February 15, 2024, 10:59pm UTC](https://community.developer.atlassian.com/t/csp-issues-with-issue-collector-implemetation/77307 "2024-02-15T22:59:04Z")

</div>

Hey ya team. Coming across an issue when implementing the issue collector in regard to CSP. We include it within HTML like so: \<script type="text/javascript" src="https://xxxx.atlassian.net/xxxxx/com.atlassian.jira.col…

---

## [CSP Violation for internal Atlassian API links for issue icons](https://community.developer.atlassian.com/t/csp-violation-for-internal-atlassian-api-links-for-issue-icons/75603)

<div class="topic-metadata">

**Author:** [@AkashSingh1](https://community.developer.atlassian.com/u/AkashSingh1)\
**Replies:** 0\
**Last updated:** [December 19, 2023, 7:06am UTC](https://community.developer.atlassian.com/t/csp-violation-for-internal-atlassian-api-links-for-issue-icons/75603 "2023-12-19T07:06:18Z")

</div>

I’m attempting to implement an issue picker field in Forge using Jira API (/rest/api/3/issue/picker) within the Custom UI. The objective is to retrieve the icon image URL from Jira API which return this semi-url(/rest/ap…

---

## [Custom UI and @atlaskit/button](https://community.developer.atlassian.com/t/custom-ui-and-atlaskit-button/75585)

<div class="topic-metadata">

**Author:** [@StrautsAiz](https://community.developer.atlassian.com/u/StrautsAiz)\
**Replies:** 3\
**Last updated:** [December 18, 2023, 11:10pm UTC](https://community.developer.atlassian.com/t/custom-ui-and-atlaskit-button/75585 "2023-12-18T23:10:25Z")

</div>

Hi! I am new to this and tried to go through the Build a custom UI app in Jira and it worked fine. I managed to deploy/install the app and see the results in Jira :heart\_eyes:. I am unable to include any @atlaskit com…

---

## [Use Attachment Images in Custom UI](https://community.developer.atlassian.com/t/use-attachment-images-in-custom-ui/43852)

<div class="topic-metadata">

**Author:** [@anon79401834](https://community.developer.atlassian.com/u/anon79401834)\
**Replies:** 30\
**Last updated:** [October 31, 2023, 5:22am UTC](https://community.developer.atlassian.com/t/use-attachment-images-in-custom-ui/43852 "2023-10-31T05:22:54Z")

</div>

Hey there :wave:, I’m currently experimenting with UI Kit as well as Custom UI. And while it was possible for me to include Images that are attached to a Confluence Page using UI Kit, I was unsuccessful when trying the …

---

## [Accessing forge api route giveserror on Content Security Policy](https://community.developer.atlassian.com/t/accessing-forge-api-route-giveserror-on-content-security-policy/71906)

<div class="topic-metadata">

**Author:** [@FalkoGieseke](https://community.developer.atlassian.com/u/FalkoGieseke)\
**Replies:** 3\
**Last updated:** [September 11, 2023, 1:53pm UTC](https://community.developer.atlassian.com/t/accessing-forge-api-route-giveserror-on-content-security-policy/71906 "2023-09-11T13:53:27Z")

</div>

const response = await api.asUser().requestConfluence(route/wiki/api/v2/attachments/983042); fetch.js:14 Refused to connect to ‘https://confluence/wiki/api/v2/attachments/983042’ because it violates the following Conten…

---

## [Cannot load image from atlassian.net even though csp policy is set](https://community.developer.atlassian.com/t/cannot-load-image-from-atlassian-net-even-though-csp-policy-is-set/57394)

<div class="topic-metadata">

**Author:** [@MathiasHausleithner](https://community.developer.atlassian.com/u/MathiasHausleithner)\
**Replies:** 4\
**Last updated:** [May 2, 2023, 10:41am UTC](https://community.developer.atlassian.com/t/cannot-load-image-from-atlassian-net-even-though-csp-policy-is-set/57394 "2023-05-02T10:41:47Z")

</div>

Hello everyone, I have been trying to get the Issue priority icons (e.g https://\[MY-DOMAIN\].atlassian.net/images/icons/priorities/medium.svg). For this i added the following to my manifest yml: permissions: scopes: …

---

## [Uncaught TypeError: Cannot read property 'csp\_nonce' of undefined (Soy parser)](https://community.developer.atlassian.com/t/uncaught-typeerror-cannot-read-property-csp-nonce-of-undefined-soy-parser/40419)

<div class="topic-metadata">

**Author:** [@SaurabhGupta](https://community.developer.atlassian.com/u/SaurabhGupta)\
**Replies:** 2\
**Last updated:** [July 12, 2022, 11:18am UTC](https://community.developer.atlassian.com/t/uncaught-typeerror-cannot-read-property-csp-nonce-of-undefined-soy-parser/40419 "2022-07-12T11:18:36Z")

</div>

I am trying to upgrade a page which was working on Jira 7.9 to 8.5. The problem i am facing is that the soy parse is throwing below error. Uncaught TypeError: Cannot read property ‘csp\_nonce’ of undefined After debugg…

---

## [Forge CLI version 4.4.0 - 21st June 2020](https://community.developer.atlassian.com/t/forge-cli-version-4-4-0-21st-june-2020/59270)

<div class="topic-metadata">

**Author:** [@LashaniPerera](https://community.developer.atlassian.com/u/LashaniPerera)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 2:34am UTC](https://community.developer.atlassian.com/t/forge-cli-version-4-4-0-21st-june-2020/59270 "2022-06-21T02:34:34Z")

</div>

We’ve released a new version of the Forge CLI, @forge/cli@4.4.0 which includes following updates: :tada: Build product triggers for issue type created/deleted/updated events We’ve added new Jira events for issue types.…

---

## [Content Security Policies (CSP) and Custom UI issue when integrate with Facebook](https://community.developer.atlassian.com/t/content-security-policies-csp-and-custom-ui-issue-when-integrate-with-facebook/58903)

<div class="topic-metadata">

**Author:** [@HaiNguyen1](https://community.developer.atlassian.com/u/HaiNguyen1)\
**Replies:** 0\
**Last updated:** [June 7, 2022, 8:16am UTC](https://community.developer.atlassian.com/t/content-security-policies-csp-and-custom-ui-issue-when-integrate-with-facebook/58903 "2022-06-07T08:16:15Z")

</div>

I’m trying to integrate with facebook login in Forge custom UI app and I cant’ fix this error: Refused to load the script 'https://connect.facebook.net/en\_US/sdk.js' because it violates the following Content Security Po…

---

## [Modifying default-src in Content-Security-Policy](https://community.developer.atlassian.com/t/modifying-default-src-in-content-security-policy/46773)

<div class="topic-metadata">

**Author:** [@CemGndodu](https://community.developer.atlassian.com/u/CemGndodu)\
**Replies:** 7\
**Last updated:** [May 29, 2022, 8:21pm UTC](https://community.developer.atlassian.com/t/modifying-default-src-in-content-security-policy/46773 "2022-05-29T20:21:04Z")

</div>

Hi, I have a Custom UI component that uses a third-party script to render mathematical formulas. This script needs to download (many) fonts from the domain that the script itself is also coming from. However, the reques…