I created an app to prove the Docusign JS embedded signing with Focused View. I am using C# at the server and JS/jQuery at the client. I followed all of the steps in the article “How to request a signature using focused view” (https://developers.docusign.com/docs/esign-rest-api/how-to/request-signature-focused-view).
Everything on the server side is fine, but when the JS code runs to load the document for signing, I get the following permission errors:
Refused to frame 'https://apps-d.docusign.com/' because it violates the following Content Security Policy directive: "default-src 'self' https://js-d.docusign.com/". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
Refused to connect to 'http://localhost:49618/05e7fec…/browserLinkSignalR/…ationData.browserId&browserId=b7e3-320d&clientProtocol=1.3&_=1728595245739' because it violates the following Content Security Policy directive: "default-src 'self 'https://js-d.docusign.com/". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
browserLink:21 Refused to connect to 'http://localhost:49618/05e7fec…/browserLinkSignalR/…ationData.browserId&browserId=67df-3483&clientProtocol=1.3&_=1728595245767' because it violates the following Content Security Policy directive: "default-src 'self'https://js-d.docusign.com/". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
Refused to connect to 'wss://localhost:44335/DocusignJS/' because it violates the following Content Security Policy directive: "default-src 'self' https://js-d.docusign.com/". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
Note that my local app is running at https://localhost:7176/
My Content-Security-Policy header is as follows:
<meta http-equiv="Content-Security-Policy" content="default-src 'self' https://js-d.docusign.com/;">
I am assuming that there is some other header I need to correct this, but haven’t found any information about what that should be.