Magento 2.3.5 Content Security Policy false positive cdn fonts

Question

Since the update of 2.3.5 that came out today Magento built in "Content Security Policy" and that's great but now I'm wondering how to ignore/whitelist CDN font's that are now being reported as a false positive in the console log. Also it says Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Does someone have more experience with "Content Security Policy" that can help me out?

[Report Only] Refused to load the script 'https://kit.fontawesome.com/a0b92fa8c0.js' because it violates the following Content Security Policy directive: 
"script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". 
Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Answer 1

etc/csp_whitelist.xml

Need to implement our own whitelist using above file

see https://devdocs.magento.com/guides/v2.4/extension-dev-guide/security/content-security-policies.html

pros:

• format evaluation using schema

cons:

• there is no way to declare schema type entry
• however you can whitelist schemes declaring host with schema name, just need to add : after the schema name eg: <value id="data-schema" type="host">data:</value>

this is the recommended way by Magento

---

etc/config.xml

whitelist can be declared as config node with specific tags using above file

see vendor/magento/module-csp/etc/config.xml

pros:

• can be inserted to the core_config_data table via environment configuration or data patch

cons:

• if it is stored in DB data patch required to change/modify

---

Implement custom policy collector

see vendor/magento/module-csp/etc/di.xml and vendor/magento/module-csp/Model/Collector/CspWhitelistXmlCollector.php

• inject your custom collector into collectors argument of Magento\Csp\Model\CompositePolicyCollector.
• Custom collector have to implements Magento\Csp\Api\PolicyCollectorInterface
• insert policies using Magento\Csp\Model\Policy\FetchPolicy

pros:

• you can use nonce type whitelists
• highly customizable
• possible to create standard, composer ready solution with chance to adjust whitelist thru configuration (eg using https://devdocs.magento.com/guides/v2.4/ext-best-practices/tutorials/dynamic-row-system-config.html to store whitlelist element)

cons:

• developer knowledge required

Answer 2

Hello I am also just about to read in. If you have an own module in the app/code then you must create the following file.

app/code/modul_modul/etc/csp_whitelist.xml

Example:

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Google-->
                <value id="google-analytics" type="host">www.google-analytics.com</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Design-->
                <value id="typekit" type="host">*.typekit.net</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="klarna-base" type="host">https://cdn.klarna.com</value>

                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>

                <!--Video-->
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="youtube-img" type="host">https://s.ytimg.com</value>

                <!--Functions-->
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Payments-->
                <value id="paypal" type="host">*.paypal.com</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <!--CDN-->
                <value id="cloudflare" type="host">*.cloudflare.com</value>

                <!--Design-->
                <value id="typekit" type="host">*.typekit.net</value>

                <!--Functions-->
                <value id="trustedshops" type="host">*.trustedshops.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

in your case

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Answer 3

You can just disable Magento_Csp entirely in Magento 2.3.5 since it offers little or no value.

More info https://maxchadwick.xyz/blog/magento-2-3-5-csp-fools-errand https://maxchadwick.xyz/blog/magento-disable-csp

Answer 4

Try below code :

<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
<policy id="script-src">
        <values>
            <value id="fontawesome-com" type="host">fontawesome.com</value>
        </values>
    </policy>
</csp_whitelist>

Answer 5

as said by Materix, put the xml in the etc folder. I put that file in the following path: /app/code/Magento/Csp/etc/csp_whitelist.xml

I wish it could help someone.

Answer 6

CSP Informations for Google Services: developers.google.com/tag-manager/web/csp