# Can't embed instagram post on custom plugin visualization

**URL:** <https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181>\
**Category:** Kibana\
**Created:** [March 18, 2020, 7:45pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181 "2020-03-18T19:45:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jessica\_Langanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessica_langanz/32/64692_2.png) [@Jessica\_Langanz](https://discuss.elastic.co/u/Jessica_Langanz)\
**Post date:** [March 18, 2020, 7:45pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181/1 "2020-03-18T19:45:30Z")

</div>

I am creating a kibana plugin that embeds an instagram post and receiving this error:

```
C:\Users\User\Documents\Projects\kibana\plugins\kbn_tp_custom_visualizations\node_modules\react-instagram-embed\lib\index.js:135 Refused to load the script 'http://platform.instagram.com/en_US/embeds.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'nonce-CqL6nSDD5P//hIcm'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

```

I am aware that i need to add a csp rule to the kibana.yml file, i have tried the following:

- "script-src 'unsafe-eval' [http://platform.instagram.com/en\_US/embeds.js](http://platform.instagram.com/en_US/embeds.js)"
- "script-src 'self' [http://platform.instagram.com/en\_US/embeds.js](http://platform.instagram.com/en_US/embeds.js)"
- "script-src [http://platform.instagram.com/en\_US/embeds.js](http://platform.instagram.com/en_US/embeds.js)"

---

<div class="post-metadata">

**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\
**Post date:** [March 18, 2020, 8:40pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181/2 "2020-03-18T20:40:23Z")

</div>

@Jessica_Langanz,

Welcome to our community!

Let me see if @Larry_Gregory can help out with this.

Thanks,  
Liza

---

<div class="post-metadata">

**Author:** ![jportner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jportner/32/75692_2.png) [@jportner](https://discuss.elastic.co/u/jportner)\
**Post date:** [March 19, 2020, 7:12pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181/3 "2020-03-19T19:12:52Z")

</div>

Hi Jessica,

I think you may have had trouble because Kibana needs the `script-src` directive to have _both_ `'unsafe-eval'` and `'self'`.

Try adding this to your kibana.yml file:

```auto
csp.rules:
 - "script-src 'unsafe-eval' 'self' https://platform.instagram.com/en_US/embeds.js"

```

Note, the rule uses the "HTTPS" version of that URL, which is highly recommended. You should update your plugin to use that as well.

Hope that helps,  
-Joe

---

<div class="post-metadata">

**Author:** ![Jessica\_Langanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessica_langanz/32/64692_2.png) [@Jessica\_Langanz](https://discuss.elastic.co/u/Jessica_Langanz)\
**Post date:** [March 19, 2020, 7:30pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181/4 "2020-03-19T19:30:46Z")

</div>

Thank you, it is working now!

I have also figured out that the lib that i am using `react-instagram-embed` makes requests on both HTTP's and HTTPS's version of that url, that was confusing me too.

TY

-Jess

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2020, 7:30pm UTC](https://discuss.elastic.co/t/cant-embed-instagram-post-on-custom-plugin-visualization/224181/5 "2020-04-16T19:30:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.