Content Security Policy & External JavaScript Libraries — Powell Software

Applies to: Powell Software on SharePoint Online 

Last updated: March 2026 

Audience: IT Administrators · Portal Administrators · Developers

Table of Contents

1. What is Content Security Policy?
2. SharePoint Online CSP Enforcement
3. How Powell Software Manages CSP
4. Authorized Domains — Complete List
5. External JavaScript Libraries
6. Troubleshooting — If a Resource is Blocked
7. FAQ

1. What is Content Security Policy?

A Content Security Policy (CSP) is a browser security mechanism that controls which external domains a web application is allowed to load resources from — scripts, stylesheets, images, and more.

When a resource is loaded from a domain not listed in the policy, the browser blocks it and logs an error. This protects your portal against:

• Cross-Site Scripting (XSS) — injected malicious scripts
• Data injection attacks — unauthorized data exfiltration
• Supply chain attacks — unexpected third-party code execution

SharePoint Online applies CSP at the tenant level through its Trusted Script Sources setting. Any external script or stylesheet loaded by Powell Software must be declared in this list, or it will be blocked.

2. SharePoint Online CSP Enforcement

SharePoint Online began enforcing CSP on March 1, 2026. Any external resource not declared in Trusted Script Sources is now blocked on all modern SharePoint pages.

Timeline

Emergency Delay (IT Admins only)

If CSP enforcement causes a critical outage, a tenant administrator can delay enforcement by 90 days using the SharePoint Online Management Shell:

Set-SPOTenant -DelayContentSecurityPolicyEnforcement $true
# Important: Run Get immediately after Set to persist the change (known issue)
(Get-SPOTenant).DelayContentSecurityPolicyEnforcement

This delay expires permanently on June 1, 2026. Use only as a last resort.

Test CSP on a Specific Page

To test CSP enforcement on a page without changing tenant settings, append one of these parameters to the page URL:

3. How Powell Software Manages CSP

Powell Software automatically manages the list of authorized external domains as part of its deployment and update process. When you provision a Powell Software site or run a synchronization from Powell Manager, the required domains are added to your SharePoint tenant's Trusted Script Sources.

You do not need to manually manage Trusted Script Sources for Powell Software features. The synchronization handles this automatically.

Limits

SharePoint Online supports a maximum of 300 entries in Trusted Script Sources. Powell Software uses 22 entries, leaving ample room for your own custom additions.

4. Authorized Domains — Complete List

The following 22 domains are managed by Powell Software and are automatically added to your tenant's Trusted Script Sources during synchronization.

5. External JavaScript Libraries

Powell Software loads several third-party JavaScript libraries on demand — only when the feature that needs them is used. This approach reduces initial page load time and avoids loading code for features that are not active.

All libraries listed below are loaded from public CDNs (jsDelivr or cdnjs.cloudflare.com) and are covered by the CSP entries in section 4.

Rich Text Editing

Froala Editor

Also loads: - Language packs (/js/languages/[locale].js) based on the user's interface language - Paragraph Format Extended plugin (froala-editor-paragraph-format-extended-plugin@0.2)

Data Visualization

Chart.js

Chart.js Moment Adapter

Image Handling

Cropper.js

Browser Image Compression

Fabric.js

Adaptive Cards

Microsoft Adaptive Cards

Maps & Geolocation

Google Maps JavaScript API

Prerequisites: A valid Google Maps API key must be configured in the Powell Software widget settings. The key requires the Maps JavaScript API and Places API to be enabled in Google Cloud Console.

Leaflet

Media

YouTube IFrame API

Code Editors

ACE Editor

Loads the following ACE modes on demand: - mode-javascript.min.js — JavaScript syntax highlighting - mode-json.min.js — JSON syntax highlighting - mode-html.min.js — HTML syntax highlighting

Social

Facebook JavaScript SDK

Utilities

modern-screenshot

PDFObject

6. Troubleshooting — If a Resource is Blocked

Symptom

A Powell Software feature is not working (blank area, missing chart, editor not loading) and the browser console shows an error such as:

Refused to load the script 'https://cdn.jsdelivr.net/npm/chart.js@3.9.1/dist/chart.min.js'
because it violates the following Content Security Policy directive: "script-src ..."

Diagnosis Steps

1. Open browser DevTools (F12) → Console tab → Look for Refused to load errors.
2. Identify the blocked domain from the error message.
3. Check if the domain is in the list in section 4 above.

Resolution

View All Current Trusted Script Sources (Admin)

Connect-SPOService -Url https://yourtenant-admin.sharepoint.com
Get-SPOTenantCdnPolicies -CdnType Private

7. FAQ

Q: Do I need to manually add domains to SharePoint Trusted Script Sources for Powell Software? Generally no — Powell Software domains are handled automatically during provisioning. However, if a domain is missing after a product update or a sync issue, you can add it manually from the SharePoint Online admin center under Settings > Trusted Script Sources, or via the SharePoint Online Management Shell.

Q: What happens if I skip a Powell Software sync after an update? New external resources added in a product update may be blocked until synchronization is run. If you notice features breaking after an upgrade, contact Powell Software Support.

Q: Can I add my own custom domains to the authorized list? Yes. For custom integrations requiring additional external domains, add them manually from the SharePoint Online admin center under Settings > Trusted Script Sources, or via PowerShell. The 300-entry SharePoint limit applies to the combined total.

Q: Are these libraries loaded for every user on every page? No. All third-party libraries listed in section 5 are loaded on demand — only when the specific feature is present and active on the page being viewed.

For further assistance, contact Powell Software Support.