Forum Discussion
AdaptiveCard video media blocked on Outlook Web by media-src CSP
Hey,
I'm having an issue with viewing videos on Outlook Web added to an AdaptiveCard then sent to a recipient. The send works, the adaptive card comes through correctly with all the appropriate IDs, I can see the video and the thumbnail. I've verified this using the "Actionable Messages Debugger" add-in on both Outlook Desktop and Outlook Web.
The problem is when viewing the message from my inbox on Outlook Web, I click the video, it goes to load and is blocked by the CSP policy for outlook.office.com. The result is the same in Edge, Chrome and Firefox. The video plays correctly from the Outlook desktop client.
Refused to load media from <server> because it violates the following Content Security Policy directive: "media-src blob: *.res.office365.com *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft *.sharepoint-df.com *.skype.com *.office.net *.office365.net *.office365-net.us *.office.com 'self' *.yammer.com *.engage.cloud.microsoft attachments.office.net attachment.outlook.live.net *.sharepoint.com".
The video itself is hosted on an app service in Azure whose domain name is not listed above. I would expect the video to work regardless of where it's hosted though (within reason).
The issue persists even when using the video used in the actual documentation for AdaptiveCards here:
https://learn.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/cards/media-elements-in-adaptive-cards?tabs=desktop
The example video there is hosted at adaptivecardsblob.blob.core.windows.net
Any insight, particularly from Microsoft, would be appreciated.
1 Reply
Any update on this? Particularly any comment from Microsoft? To be clear I do understand what the problem is and why it's happening. What I don't understand is why Microsoft has imposed this restriction on their entire online mail platform. Is the intent to restrict all AdaptiveCard media links opened on Outlook Online to only those hosted on a handful of their own domains? As a developer trying to leverage AdaptiveCards, it's discouraging to not have all media links (within reason) function correctly on all forms of Outlook.
