This message was deleted.

It looks like your frame-ancestors directive is being rejected, and the policy falls back to the default of 'none'. Two common pitfalls from the shared materials: 1) Include 'self' first and only valid sources (no protocols on hostnames, no angle brackets, no paths/slashes). Also ensure the directive name is exact: frame-ancestors. [[Enable CSP](https://www.gooddata.com/docs/cloud/manage-organization/set-up-csp-for-organization/)] - Correct examples: - 'self' http://angular.local - 'self' https://yourapp.example.com - Incorrect examples: - 'self' https://*.gooddata.com http://angular.local (mixing scheme with wildcard host can be fine, but avoid odd formatting such as <http://...> or trailing slashes) - 'self' https://*.gooddata.com http://angular.local (angle brackets or markdown link formatting will invalidate) - 'self' http://angular.local/ (no slashes allowed) - 'self' https://*.gooddata.com gooddata.com (Slack-style links are invalid) 2) GoodData guidance: when adding frame-ancestors, remember to include 'self' to avoid issues with embedding. [[Enable CSP](https://www.gooddata.com/docs/cloud/manage-organization/set-up-csp-for-organization/)] What to do - Recreate the directive cleanly via API or UI, with plain sources only: - frame-ancestors: 'self' http://angular.local - If you also embed from another domain(s), add them as space-separated entries: - frame-ancestors: 'self' http://angular.local https://yourapp.example.com - Avoid Markdown/Slack link syntax when sending values (e.g., http://angular.local or gooddata.com), which will be stored literally and break the directive. How to set via API (example)

curl -X POST -H "Authorization: Bearer $API_TOKEN" \   -H "Content-type: application/vnd.gooddata.api+json" \   "$HOST_URL/api/v1/entities/cspDirectives" \   -d '{     "data": {       "id": "frame-ancestors",       "type": "cspDirective",       "attributes": {         "sources": [           "'self'",           "<http://angular.local>"         ]       }     }   }'

You can list current directives to verify what’s actually stored and remove a problematic one if needed: - GET /api/v1/entities/cspDirectives - DELETE /api/v1/entities/cspDirectives/frame-ancestors [[Enable CSP](https://www.gooddata.com/docs/cloud/manage-organization/set-up-csp-for-organization/); [Slack thread](https://gooddataconnect.slack.com/archives/C04S1MSLEAW/p1724965344889679?thread_ts=1724965344.889679&amp;cid=C04S1MSLEAW)] Extra checks - If you previously removed CSP due to earlier issues, adding frame-ancestors with 'self' has been confirmed to fix embedding errors. [[Slack thread](https://gooddataconnect.slack.com/archives/C04S1MSLEAW/p1721333506058649?thread_ts=1721333506.058649&amp;cid=C04S1MSLEAW)] - Ensure you are editing the organization’s CSP where your embedded dashboards are served. [[Enable CSP](https://www.gooddata.com/docs/cloud/manage-organization/set-up-csp-for-organization/)] If after correcting the directive you still see 'none' in the browser, it usually means: - Another layer (proxy/CDN) injects/overrides CSP headers; or - The directive wasn’t saved as intended (check with the GET endpoint). Let me know what your GET /cspDirectives returns and the exact parent page URL you embed from, and I can help validate the final sources string.