PowerBI-Dashboards fail to load — onHeadersReceived overrides upstream CORS-Headers and needed font/content-src CSP is missing

[maximvspayne]

Bug Report: Power BI integration broken in v4.0.8 — CORS headers override upstream responses and CSP (https://wabi-germany-west-central-primary-api.analysis.windows.net + https://fs.microsoft.com) missing in Config.

Summary

Power BI dashboards cannot be displayed in the Xibo Player v4.0.8 due to two issues in the generated index.js:

The player injects Access-Control-Allow-Methods and Access-Control-Allow-Headers into every response via onHeadersReceived, overriding the headers that Power BI's servers set themselves. This breaks CORS for Power BI embeds.
The CSP (https://wabi-germany-west-central-primary-api.analysis.windows.net + https://fs.microsoft.com) missing in Config.

Environment

Xibo Player version: 4.0.8
Package: xibo-player (.deb)
Affected file: /usr/lib/xibo-player/resources/app/dist/main/index.js
Power BI region: Germany West Central (wabi-germany-west-central-primary-api.analysis.windows.net)
OS: Linux Mint 22.3 (Ubuntu/Debian-based)
Current (buggy) behavior
Power BI dashboards embedded in Xibo widgets fail to load. The browser console reports CORS errors and blocked font/resource requests. The embedded iframe shows an error state.

Root cause
In the bundled index.js, the onHeadersReceived handler currently looks like this:

...
"Access-Control-Allow-Methods": ["GET, POST, PUT, DELETE, OPTIONS"],
"Access-Control-Allow-Headers": ["Content-Type, Authorization", "x-preview-jwt"]
...

and misses the CSP (https://wabi-germany-west-central-primary-api.analysis.windows.net + https://fs.microsoft.com) which are needed for the PowerBI Dash to work in Xibo Player.

Issue 1: CORS headers override upstream responses
The onHeadersReceived handler unconditionally adds Access-Control-Allow-Methods and Access-Control-Allow-Headers to every HTTP response. For Power BI embeds, the Power BI backend already sets these headers with the correct values for its own origin. The player's injected headers overwrite those values, leading to:

Mismatched Access-Control-Allow-Headers values (e.g. x-preview-jwt is added which Power BI's servers don't expect)
Browser blocking the cross-origin request due to CORS validation failure
These injected CORS headers serve no apparent purpose for local Xibo content and actively break third-party embeds that manage their own CORS headers.

Issue 2: Missing CSP URL's which are necessary for PowerBI to work within the Xibo-Player
CSP (https://wabi-germany-west-central-primary-api.analysis.windows.net + https://fs.microsoft.com) missing in Config.

Changes:

Remove Access-Control-Allow-Methods and Access-Control-Allow-Headers from the injected response headers. These should not be overridden globally — third-party services like Power BI manage their own CORS headers.
Ensure https://fs.microsoft.com is listed as an explicit, standalone source in font-src.
Impact
Power BI embeds are completely broken in v4.0.8 for users in the Germany West Central region (and likely other regions with similar configurations).
Any third-party embedded content that sets its own CORS headers may be affected, not just Power BI.
Users currently need to manually patch the bundled index.js after installation to work around this.
Workaround
A shell script that patches the deployed index.js after installation is available on request. It:

Removes the injected CORS headers
Ensures CSP (https://wabi-germany-west-central-primary-api.analysis.windows.net + https://fs.microsoft.com) is present in font/content-src
Creates a timestamped backup before modifying
Validates the result after patching
Additional notes
The Power BI API endpoint in connect-src (https://wabi-germany-west-central-primary-api.analysis.windows.net) is hardcoded for the Germany West Central region. Future versions should ideally make this configurable or include all regional endpoints.
The frame-src already permits https: and http: broadly, which is sufficient for embedding — the blocker is purely the CORS header injection.

Here's a working Script that fixes these Showstoppers:
patch-xibo-powerbi.sh

Skript anzeigen (patch-xibo-powerbi.sh)

#!/bin/bash

set -euo pipefail

PACKAGE="xibo-player"
EXPECTED_VERSION="4.0.8"
INDEX="/usr/lib/xibo-player/resources/app/dist/main/index.js"

echo "=== Xibo Player 4.0.8 Power-BI Patch - 2026 mbrennich @Tardis GmbH ==="
echo

# ------------------------------------------------------------
# Root check
# ------------------------------------------------------------

if [[ $EUID -ne 0 ]]; then
    echo "FEHLER: Dieses Skript muss als root ausgeführt werden."
    echo
    echo "Verwendung:"
    echo "  sudo $0"
    exit 1
fi

# ------------------------------------------------------------
# Package check
# ------------------------------------------------------------

if ! dpkg-query -W -f='${Status}' "$PACKAGE" 2>/dev/null \
    | grep -q "install ok installed"; then

    echo "FEHLER: $PACKAGE ist nicht installiert."
    exit 1
fi

VERSION="$(dpkg-query -W -f='${Version}' "$PACKAGE")"

echo "Gefundene Xibo-Version: $VERSION"

if [[ "$VERSION" != "$EXPECTED_VERSION" ]]; then
    echo
    echo "FEHLER: Dieses Skript ist ausschließlich für"
    echo "Xibo Player $EXPECTED_VERSION vorgesehen."
    echo "Gefunden wurde: $VERSION"
    exit 1
fi

# ------------------------------------------------------------
# File check
# ------------------------------------------------------------

if [[ ! -f "$INDEX" ]]; then
    echo
    echo "FEHLER: index.js nicht gefunden:"
    echo "$INDEX"
    exit 1
fi

echo "index.js:"
echo "  $INDEX"

# ------------------------------------------------------------
# Check whether desired state is already installed
# ------------------------------------------------------------

if grep -q '"Access-Control-Allow-Headers"' "$INDEX"; then
    NEED_CORS_PATCH=1
else
    NEED_CORS_PATCH=0
fi

if grep -q '"Access-Control-Allow-Methods"' "$INDEX"; then
    NEED_CORS_PATCH=1
fi

# Check for our desired CSP
if grep -q \
    "https://wabi-germany-west-central-primary-api.analysis.windows.net" \
    "$INDEX" && \
   grep -q \
    "https://fs.microsoft.com data:;" \
    "$INDEX"; then
    CSP_PRESENT=1
else
    CSP_PRESENT=0
fi

if [[ "$NEED_CORS_PATCH" -eq 0 && "$CSP_PRESENT" -eq 1 ]]; then
    echo
    echo "Der gewünschte Power-BI-Patch ist bereits vorhanden."
    echo "Keine Änderung notwendig."
    exit 0
fi

# ------------------------------------------------------------
# Verify Xibo 4.0.8 structure before modifying anything
# ------------------------------------------------------------

echo
echo "Prüfe erwartete Xibo-4.0.8-Struktur..."

if ! grep -q \
    'require\$\$0\.session\.defaultSession\.webRequest\.onHeadersReceived' \
    "$INDEX"; then

    echo
    echo "FEHLER: onHeadersReceived-Struktur nicht gefunden."
    echo "Die Datei entspricht möglicherweise nicht dem erwarteten"
    echo "Xibo Player 4.0.8 Build."
    echo
    echo "Es wird NICHTS geändert."
    exit 1
fi

if ! grep -q \
    '"Access-Control-Allow-Headers": \["Content-Type, Authorization", "x-preview-jwt"\]' \
    "$INDEX" && \
   [[ "$NEED_CORS_PATCH" -eq 1 ]]; then

    echo
    echo "WARNUNG: Der erwartete ursprüngliche"
    echo "Access-Control-Allow-Headers-Eintrag wurde nicht gefunden."
    echo
    echo "Es wird NICHTS geändert."
    exit 1
fi

# ------------------------------------------------------------
# Backup
# ------------------------------------------------------------

BACKUP="${INDEX}.before-powerbi-patch.$(date +%Y%m%d-%H%M%S).bak"

echo
echo "Erstelle Backup:"
echo "  $BACKUP"

cp -a "$INDEX" "$BACKUP"

# ------------------------------------------------------------
# Patch using Python
# ------------------------------------------------------------

echo
echo "Setze Xibo Power-BI-Konfiguration..."

python3 - "$INDEX" <<'PY'
import sys
import re

path = sys.argv[1]

with open(path, "r", encoding="utf-8") as f:
    data = f.read()

# ------------------------------------------------------------
# Locate the complete onHeadersReceived block.
#
# This deliberately matches the known Xibo Player 4.0.8
# generated JavaScript structure.
# ------------------------------------------------------------

pattern = re.compile(
    r'''require\$\$0\.session\.defaultSession\.webRequest\.onHeadersReceived\(\(details, callback\) => \{
\s*callback\(\{
\s*responseHeaders: \{
\s*\.\.\.details\.responseHeaders,
\s*"Content-Security-Policy": \[
\s*"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:9696; style-src 'self' 'unsafe-inline' http://localhost:9696; img-src 'self' http://localhost:9696 https://develop\.xibo\.co\.uk data: https:; connect-src 'self' http://localhost:9696 https://auth\.signlicence\.co\.uk https://wabi-germany-west-central-primary-api\.analysis\.windows\.net; media-src 'self' http://localhost:9696 https:; frame-src 'self' http://localhost:9696 https: http:; font-src 'self' http://localhost:9696 http://localhost(?: https://fs\.microsoft\.com)? data:;"
\s*\]
\s*(?:,\s*"Access-Control-Allow-Methods": \["GET, POST, PUT, DELETE, OPTIONS"\])?
\s*(?:,\s*"Access-Control-Allow-Headers": \["Content-Type, Authorization", "x-preview-jwt"\])?
\s*\}
\s*\}\);
\s*\}\);''',
    re.MULTILINE
)

replacement = '''require$$0.session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
    callback({
      responseHeaders: {
        ...details.responseHeaders,
        "Content-Security-Policy": [
          "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:9696; style-src 'self' 'unsafe-inline' http://localhost:9696; img-src 'self' http://localhost:9696 https://develop.xibo.co.uk data: https:; connect-src 'self' http://localhost:9696 https://auth.signlicence.co.uk https://wabi-germany-west-central-primary-api.analysis.windows.net; media-src 'self' http://localhost:9696 https:; frame-src 'self' http://localhost:9696 https: http:; font-src 'self' http://localhost:9696 http://localhost https://fs.microsoft.com data:;"
        ]
      }
    });
  });'''

match = pattern.search(data)

if not match:
    raise SystemExit(
        "FEHLER: Der erwartete onHeadersReceived-Block wurde "
        "nicht exakt gefunden."
    )

data = data[:match.start()] + replacement + data[match.end():]

with open(path, "w", encoding="utf-8") as f:
    f.write(data)
PY

# ------------------------------------------------------------
# Verify final state
# ------------------------------------------------------------

echo
echo "Prüfe Ergebnis..."

# CORS overrides must be gone
if grep -q '"Access-Control-Allow-Headers"' "$INDEX"; then
    echo "FEHLER: Access-Control-Allow-Headers ist noch vorhanden."
    echo "Stelle Backup wieder her."
    cp -a "$BACKUP" "$INDEX"
    exit 1
fi

if grep -q '"Access-Control-Allow-Methods"' "$INDEX"; then
    echo "FEHLER: Access-Control-Allow-Methods ist noch vorhanden."
    echo "Stelle Backup wieder her."
    cp -a "$BACKUP" "$INDEX"
    exit 1
fi

# Required Power BI endpoints must be present
if ! grep -q \
    "https://wabi-germany-west-central-primary-api.analysis.windows.net" \
    "$INDEX"; then

    echo "FEHLER: Power-BI-API fehlt in connect-src."
    echo "Stelle Backup wieder her."
    cp -a "$BACKUP" "$INDEX"
    exit 1
fi

if ! grep -q \
    "https://fs.microsoft.com" \
    "$INDEX"; then

    echo "FEHLER: fs.microsoft.com fehlt in font-src."
    echo "Stelle Backup wieder her."
    cp -a "$BACKUP" "$INDEX"
    exit 1
fi

# Verify desired CSP contains the expected Power BI additions
if ! grep -q \
    "font-src 'self' http://localhost:9696 http://localhost https://fs.microsoft.com data:;" \
    "$INDEX"; then

    echo "FEHLER: font-src entspricht nicht dem gewünschten Stand."
    echo "Stelle Backup wieder her."
    cp -a "$BACKUP" "$INDEX"
    exit 1
fi

echo
echo "=========================================="
echo " PATCH ERFOLGREICH"
echo "=========================================="
echo
echo "Folgende Änderungen wurden vorgenommen:"
echo
echo "  [ENTFERNT]"
echo "    Access-Control-Allow-Methods"
echo "    Access-Control-Allow-Headers"
echo
echo "  [GESETZT]"
echo "    Power-BI CSP / connect-src"
echo "    Power-BI Microsoft Font CSP / font-src"
echo
echo "Backup:"
echo "  $BACKUP"
echo
echo "Der Xibo Player muss vollständig neu gestartet werden."
echo