Trouble with CSP after publishing dev app

ChatGPT Apps SDK
, ,
1

In developer mode, I’m able to add mcp servers and widgets quite easily and they are able to load their UIs. However, when I publish the app to my workspace (so other people at my company who don’t have developer mode can help test it out) I get the following error after the UI flashes for a second and disappears with the following error in console:
main-DysC7zh_.js:5 Loading the script ‘https://<MY_DOMAIN>/widgets/<MY_PAGE>.js’ violates the following Content Security Policy directive: “script-src ‘self’ ‘wasm-unsafe-eval’ ‘unsafe-inline’ ‘unsafe-eval’ blob: tailwind dot com cdn dot jsdelivr dot net unpkg dot com https://*.oaiusercontent.com threejs dot org”. Note that ‘script-src-elem’ was not explicitly set, so ‘script-src’ is used as a fallback. The action has been blocked.

main-DysC7zh_.js:5 Loading the script ‘https://<MY_DOMAIN>/widgets/<MY_PAGE>.css’ violates the following Content Security Policy directive: “script-src ‘self’ ‘wasm-unsafe-eval’ ‘unsafe-inline’ ‘unsafe-eval’ blob: tailwind dot com cdn dot jsdelivr dot net unpkg dot com https://*.oaiusercontent.com threejs dot org”. The action has been blocked.

Have been trying to work through this but unable to get it to go away, has anyone else encountered this issue?

2

Hi @rlittl

Are you declaring the domains your widget will load resources from via _meta["openai/widgetCSP"]?

The docs explicitly call out that this is required before broad distribution , and that the sandbox blocks everything else.

1 Like
3

I’ve registered the widget as follows:

  @mcp.resource(
      "ui://widgets/<title>.html",
      mime_type="text/html+skybridge",
      meta={
          ...
          "openai/widgetCSP": {
              "connect_domains": ["<domain>"],
              "resource_domains": ["<domain>"],
          },
      },
  )

I believe I may be running into a similar issue as this thread (I’m using fastMCP):

https:// community.openai. com/t/issue-fastmcp-resources-cannot-return-meta-in-read-responses-but-openai-client-expects-it/1368892

4

@sps Any guidance here? Would really appreciate any knowledge you have in this area