# CSP in Kibana

**URL:** <https://discuss.elastic.co/t/csp-in-kibana/248149>\
**Category:** Kibana\
**Created:** [September 10, 2020, 10:54am UTC](https://discuss.elastic.co/t/csp-in-kibana/248149 "2020-09-10T10:54:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alder/32/58170_2.png) [@Alder](https://discuss.elastic.co/u/Alder)\
**Post date:** [September 10, 2020, 10:54am UTC](https://discuss.elastic.co/t/csp-in-kibana/248149/1 "2020-09-10T10:54:57Z")

</div>

Hello to all of the elastic team.

I'm trying create a space with the C# code below. The http response suggests that CSP rules are blocking my request

```auto
    private void testCreateSpace()
    {
        string spaceJson = "{\"id\": \"alder_id\",\"name\": \"Alder\",\"description\" : \"Teste de criação de space Alder\"}";

        using (var wb = new WebClient())
        {
            wb.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36");
            wb.Headers.Add("username","elastic");
            wb.Headers.Add("password", "passtest");
            var response = wb.UploadString("http://win-5jrakspu4gn:5601/api/spaces/space", "POST", spaceJson);

            Console.WriteLine(response);
        }
    }

```

I tried the settings on kibana.yml but not successful, the blocking continues

```auto
csp.strict: false

```

Version Kibana 7.8.1  
Version Elastic 7.8.1

Att,  
Alder

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [September 10, 2020, 10:59am UTC](https://discuss.elastic.co/t/csp-in-kibana/248149/2 "2020-09-10T10:59:49Z")

</div>

Can you show the exact error you are running into? In general, CSP rules are enforced on the client, so you should be able to resolve this in your C# code.

---

<div class="post-metadata">

**Author:** ![Alder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alder/32/58170_2.png) [@Alder](https://discuss.elastic.co/u/Alder)\
**Post date:** [September 10, 2020, 11:28am UTC](https://discuss.elastic.co/t/csp-in-kibana/248149/3 "2020-09-10T11:28:26Z")

</div>

Thanks for the quick reply  
The response is very long, follow just end of it.

```auto
<div class="kbnWelcomeText" data-error-message="Elastic did not load properly. Check the server output for more information.">Loading Elastic</div><div class="kbnProgress"></div></div></div><div class="kbnWelcomeView" id="kbn_legacy_browser_error" style="display:none"><svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" 

...

 Z"></path></g></svg><h2 class="kbnWelcomeTitle">Please upgrade your browser</h2><div class="kbnWelcomeText">This Elastic installation has strict security requirements enabled that your current browser does not meet.</div></div><script>
            // Since this is an unsafe inline script, this code will not run
            // in browsers that support content security policy(CSP). This is
            // intentional as we check for the existence of __kbnCspNotEnforced__ in
            // bootstrap.
            window. __kbnCspNotEnforced__ = true;
          </script><script src="/bundles/app/core/bootstrap.js"></script></body></html>

```

---

<div class="post-metadata">

**Author:** ![Alder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alder/32/58170_2.png) [@Alder](https://discuss.elastic.co/u/Alder)\
**Post date:** [September 10, 2020, 2:07pm UTC](https://discuss.elastic.co/t/csp-in-kibana/248149/4 "2020-09-10T14:07:42Z")

</div>

I found the error, the kbn-xsrf header was not set.  
Authentication was enabled and masked the principal error  
Thanks for the answers, helped me to solve the problem

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2020, 2:07pm UTC](https://discuss.elastic.co/t/csp-in-kibana/248149/5 "2020-10-08T14:07:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.