# Console error - Missing OWASP Secure Headers:

**URL:** <https://devforum.zoom.us/t/console-error-missing-owasp-secure-headers/71706>\
**Category:** Zoom Apps\
**Created:** [July 5, 2022, 11:03pm UTC](https://devforum.zoom.us/t/console-error-missing-owasp-secure-headers/71706 "2022-07-05T23:03:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohan.rasane.adm](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@rohan.rasane.adm](https://devforum.zoom.us/u/rohan.rasane.adm)\
**Post date:** [July 5, 2022, 11:03pm UTC](https://devforum.zoom.us/t/console-error-missing-owasp-secure-headers/71706/1 "2022-07-05T23:03:49Z")

</div>

While building the Zoom App, Im trying to call the deeplink api in my flow so that I can open my app in the Zoom client, but Im getting the console error 'Missing OWASP Secure Headers: [“Content-Security-Policy”]  
I’m passing the security headers and I also have the domain in the allow list.  
Here is the image that shows the headers that Im passing.

 ![Screen Shot 2022-07-05 at 4.01.17 PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/7/9/79176b0ed7a9e51bcd6f5b407416e6709758474f.png)

I assume that the user has to manually open the url that is received in the deeplink api url. The sample response looks like this

{“deeplink”:“[https://zoom.us/launch/zoomapp/](https://zoom.us/launch/zoomapp/){some id}”}

---

<div class="post-metadata">

**Author:** ![daniel.fried](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@daniel.fried](https://devforum.zoom.us/u/daniel.fried)\
**Post date:** [July 6, 2022, 5:51pm UTC](https://devforum.zoom.us/t/console-error-missing-owasp-secure-headers/71706/2 "2022-07-06T17:51:05Z")

</div>

Hi Rohan, can you confirm that these headers are provided when the “Home URL” of your app is requested?

Can you also provide the full value of your CSP?

Final note, I think that X-Frame-Option should be plural i.e. X-Frame-Options