# \[ SOLVED\] Adding custom csp rule on Elastic Cloud : 'csp.rules': is not allowed - Not possible yet **URL:** \ **Category:** Kibana\ **Created:** [April 17, 2020, 12:46pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513 "2020-04-17T12:46:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![IanCap](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@IanCap](https://discuss.elastic.co/u/IanCap)\ **Post date:** [April 17, 2020, 12:46pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/1 "2020-04-17T12:46:57Z")
Hi ! I'm currently trying to modify the Content Security Policy in the kibana.yml file on a Clouded Deployment to allow a custom javascript to run on a dashboard but i get the following error message when adding the csp rules ```auto csp.rules': is not allowed ``` My configuration is the following : ```auto csp.rules: # current defaults - "script-src 'unsafe-eval' 'self' 'nonce-{base64nonce}'" ``` I researched the following links first whitout success : > [@Is there any method to set content security policy only in Kibana plugin code?](https://discuss.elastic.co/t/is-there-any-method-to-set-content-security-policy-only-in-kibana-plugin-code/193899): > > Currently, I am developing a kibana plugin that uses iframe to load remote website. Here is the content of plugins/query\_ai/public/components/main/main.js: import React from 'react'; export class Main extends React.Component { constructor(props) { super(props); this.state = {}; } componentDidMount() { /\* FOR EXAMPLE PURPOSES ONLY. There are much better ways to manage state and update your UI than this. \*/ const { httpClient } = this.props; this.se… > [@Problem with google map api integration in React Kibana Plugin](https://discuss.elastic.co/t/problem-with-google-map-api-integration-in-react-kibana-plugin/213486): > > I am developing a custom plugin with React for Kibana. I need to use google geocode and reverse geocode from google map API. But I am facing a problem when I inject the API script in my react component. It seems like it refuses to connect the Google Map API network. So the API throws a network error. Refused to load the script 'https://maps.googleapis.com/maps/api/js?key={MY\_API\_KEY}&libraries=places%2Cgeometry' because it violates the following Content Security Policy directive: "script-src … > [@The problem of using iframe when developing a Kibana plugin that loads remote website](https://discuss.elastic.co/t/the-problem-of-using-iframe-when-developing-a-kibana-plugin-that-loads-remote-website/193858): > > I am developing a Kibana plugin and named it test-3. This is the content of kibana/plugins/test\_3/public/components/main/main.js: import React from 'react'; export class Main extends React.Component { constructor(props) { super(props); this.state = {}; } componentDidMount() { /\* FOR EXAMPLE PURPOSES ONLY. There are much better ways to manage state and update your UI than this. \*/ const { httpClient } = this.props; httpClient.get('../api/test3/examp… Any help would be much appreciated ! Thanks in advance, Ian ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [April 17, 2020, 2:16pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/2 "2020-04-17T14:16:17Z")
> [@IanCap](#): > > Clouded Deployment Do you mean [Elastic Cloud](https://cloud.elastic.co/)? If so, then yeah I see it's not whitelisted there yet. Thanks for letting us know! We'll take care of this as soon as possible. But for now can you try to reach out to the [Cloud support](https://cloud.elastic.co/help) to see if they can do that for you? Best, Oleg ---
**Author:** ![IanCap](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@IanCap](https://discuss.elastic.co/u/IanCap)\ **Post date:** [April 17, 2020, 2:20pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/3 "2020-04-17T14:20:14Z")
I meant Elastic Cloud indeed, sorry about the wrong name I expected that it wasn't possible yet, thanks for the quick answer ! I worked the problem an other way Instead of trying to inject a script to modify the html/css in a dynamic way, i used a module of nginx to do it in a static way : [http://nginx.org/en/docs/http/ngx\_http\_sub\_module.html](http://nginx.org/en/docs/http/ngx_http_sub_module.html) Thanks again ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [April 17, 2020, 2:22pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/4 "2020-04-17T14:22:17Z")
Thanks for sharing your solution! Yeah, that's also an option (and maybe even better than relaxed CSP rules 🙂) . ---
**Author:** ![IanCap](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@IanCap](https://discuss.elastic.co/u/IanCap)\ **Post date:** [April 17, 2020, 2:23pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/5 "2020-04-17T14:23:14Z")
Surely much better after finding the said module ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 15, 2020, 2:23pm UTC](https://discuss.elastic.co/t/solved-adding-custom-csp-rule-on-elastic-cloud-csp-rules-is-not-allowed-not-possible-yet/228513/6 "2020-05-15T14:23:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.