I try to build a workflow which convert data to a file, once i did that i found there is an option to download the file. once i click on it i got the CSP error described in the image attached. i know i can solve it by adding the data scheme but in a security manner it is not recommended. there is other way to control it and serve the file in other way?
The error as described in the browser:
While CSP is important to us, and is on our roadmap, we unfortunately can’t provide much support for CSP until we first have some version of it in the app itself.
In this case, the object-src violation is being reported because the app uses <embed> tag to show any file type that’s not audio, video, json, or html.
This is done so because having a custom mechanism to download and render every file type is going to be a lot of work.
That said, adding support for viewing text files without an <embed> should not be much work. So, let us know if this is an issue for you. we can then try to address this sooner.
