# Problem in integrating external script in Kibana Plugin

**URL:** <https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170>\
**Category:** Kibana\
**Created:** [January 8, 2020, 7:20am UTC](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170 "2020-01-08T07:20:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RaghibHuda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raghibhuda/32/59613_2.png) [@RaghibHuda](https://discuss.elastic.co/u/RaghibHuda)\
**Post date:** [January 8, 2020, 7:20am UTC](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170/1 "2020-01-08T07:20:13Z")

</div>

I am developing a plugin in Kibana with React. I need google map API for that. But when I render my component with mp API script it gives an error. I searched and found that and the reason behind it is the content security policy ( CSP ) of Kibana. The solution is to customize CSP rules though which is not recommended in Kibana documentation.

I add `csp.strict: true` in _kibana.yml_ but still throw the same error like

`Refused to load the script 'https://maps.googleapis.com/maps/api/js?key={MY_API_KEY}&libraries=places%2Cgeometry' because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.`

How can I configure `csp.rules` in `kibana.yml` to only access the google map API plugin that is  
`https://maps.googleapis.com` domain and render my map? If anyone has any working code snippet of `csp.rules` for adding a particular script in the Kibana plugin will be very helpful for me.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 9, 2020, 7:53pm UTC](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170/2 "2020-01-09T19:53:58Z")

</div>

Try this:

```auto
csp.rules:
 - "script-src 'unsafe-eval' 'self' 'https://maps.googleapis.com'"
 - "worker-src blob: 'self'"
 - "style-src 'unsafe-inline' 'self'"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2020, 7:54pm UTC](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170/3 "2020-02-06T19:54:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.