12

Since the update of 2.3.5 that came out today Magento built in "Content Security Policy" and that's great but now I'm wondering how to ignore/whitelist CDN font's that are now being reported as a false positive in the console log. Also it says Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Does someone have more experience with "Content Security Policy" that can help me out?

[Report Only] Refused to load the script 'https://kit.fontawesome.com/a0b92fa8c0.js' because it violates the following Content Security Policy directive: 
"script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". 
Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
  • Also to add to this further reading of the release notes as of 2.4.0 any not whitelisted will be blocked. – Dominic Xigen Apr 30 at 21:01
  • 1
    We are also gettings hundreds of notices and errors. – Ignacio Correia May 19 at 18:00
  • @Riccardo please let me know what is the use of this file csp_whitelist.xml why should we use this. can u please clarify – Nagaraju K Jul 6 at 6:55
8

Hello I am also just about to read in. If you have an own module in the app/code then you must create the following file.

app/code/modul_modul/etc/csp_whitelist.xml

Example:

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Google-->
                <value id="google-analytics" type="host">www.google-analytics.com</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Design-->
                <value id="typekit" type="host">*.typekit.net</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="klarna-base" type="host">https://cdn.klarna.com</value>

                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>

                <!--Video-->
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="youtube-img" type="host">https://s.ytimg.com</value>

                <!--Functions-->
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Design-->
                <value id="typekit" type="host">*.typekit.net</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

in your case

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>
| improve this answer | |
  • For a theme script placed from MyTheme/default/Magento_Theme/layout/default.xml in <head> <link src="js/myscript.js"/> </head> , where should the csp_whitelist.xml be placed? In MyTheme/default/etc/csp_whitelist.xml? Because I tried to place it there but it doesn't work. – KaMZaTa May 3 at 13:50
  • @KaMZaTa No in the theme does not work, as specified you should have your own module: app/code/modul_modul/etc/csp_whitelist.xml – Materix May 5 at 10:06
  • thanks but it doesn't work either. I run magento setup:upgrade and magento c:f after created the new module but nothing to do. Where am I wrong? – KaMZaTa May 5 at 14:11
  • @Materix, carefully followed your solution, yet there is no difference. What am I missing? – CodeForGood Jun 8 at 8:42
  • @Materix How to fix this issue prnt.sc/tcj9ee can u suggest me – Nagaraju K Jul 6 at 6:41
0

Try below code :

<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
<policy id="script-src">
        <values>
            <value id="fontawesome-com" type="host">fontawesome.com</value>
        </values>
    </policy>
</csp_whitelist>
| improve this answer | |
0

as said by Materix, put the xml in the etc folder. I put that file in the following path: /app/code/Magento/Csp/etc/csp_whitelist.xml

I wish it could help someone.

| improve this answer | |
0

You can just disable Magento_Csp entirely in Magento 2.3.5 since it offers little or no value.

More info https://maxchadwick.xyz/blog/magento-2-3-5-csp-fools-errand https://maxchadwick.xyz/blog/magento-disable-csp

| improve this answer | |
  • Thanks for the info but I've read that it will be obligated in the newer versions of Magento to come so I don't know if disabling is the right way to go .. – Riccardo Jul 15 at 12:55
0

CSP Informations for Google Services: developers.google.com/tag-manager/web/csp

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.