Skip to main content

Can't load images in Facebook Instant Games

Daniel

I'm trying to load an image in a Facebook Instant Game. But I get the following error:

Refused to load the image 'https://res.cloudinary.com/...' because it violates the following Content Security Policy directive: "img-src 'self' blob: data: *.facebook.com *.fbcdn.net *.google-analytics.com stats.g.doubleclick.net *.akamaihd.net *.giphy.com *.cloudfront.net *.amazonaws.com *.tenor.com *.googleapis.com *.firebaseapp.com *.firebaseio.com static.zyngawithfriends.zgncdn.com *.8686c.com *.cncovs.com *.aliyun.com *.aliyuncs.com *.wsdvs.com *.console.re *.akamaized.net *.kunlunar.com *.layabox.com *.playtika.com *.windows.net *.msecnd.net *.anysdk.com ".

I can load the images launching my game out of the Facebook site without problems. It seems Facebook limits the domains that you are allowed to access. Is this a known issue? Is there any workaraound?

0

Comments

5 comments

Date Votes
  • Yakir Perlin

    Hi Daniel,

    CSP defines the Content-Security-Policy HTTP header, which allows you to create a whitelist of sources of trusted content

    You should add *.cloudinary.com to img-src / media-src attribute that defines the origins from which images can be loaded.

     I'm not familiar with the Facebook Instant Games, so please try to add this setting, and let me know if it works for you.

     

    Best,

    Yakir

     

    0
  • Daniel

    I am not abble to change the CSP headers because they are defined by Facebook. There isn't any configuration to whitelist origins, so I guess that it's not possible to use Cloudinary and Instant Games for now.

    0
  • Stephen Doyle

    Hi Daniel,

    Looking at the existing list of domains Facebook allows, it appears that they're open to adding new domains to accommodate game developers' CDN providers. I would suggest that you contact whomever you've been working with on your Instant Games integration, or file a ticket for their support team and request that Cloudinary is added to the list of allowed domains.

    If you have trouble getting them to do so, may I suggest creating a ticket for our support team directly referencing this post, and we'll see what other options are available?

    Regards,

    Stephen

    0
  • Daniel

    Hi again.

    The Facebook guys kindly added the cloudinary domain to their whitelist.

    So right now it's possible to use Cloudinary from a Facebook Instant Game.

    Regards.

    0
  • Yakir Perlin

    Hi Daniel, 

    Thanks for the update, glad it works for you.

     

    Best,

    --Yakir

    0

Post is closed for comments.

Didn't find what you were looking for?

New post