Has anyone found a way to integrate the data:image/png as csp_whitelist?

[Report Only] Refused to load the image 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGP6zwAAAgcBApocMXEAAAAASUVORK5CYII=' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com *.cloudflare.com https://cdn.klarna.com *.paypal.com https://s.ytimg.com *.usercentrics.eu 'self' 'unsafe-inline'".


In your custom csp_whitelist.xml (eg. in a custom modules etc-directory) add this:

<policy id="img-src">
    <value id="data" type="host">data:</value>

The colon as suffix is the important stuff here.

| improve this answer | |
  • it fix issue but it looks like dirty workaround. Hm – Konrad Siamro May 5 at 10:10
  • thanks, this will work – Materix May 5 at 10:38
  • @KonradSiamro AFAIK the data: should be declared as scheme and not as host in the CSP regarding the CSP-specification, but the Magento-CSP-Module only supports host and hash as type - no support for real scheme-policies right now. – Tobias Wassermann May 5 at 11:15
  • ok, thanks for explanation – Konrad Siamro May 5 at 11:35
  • @Tobias Wassermann, I have been trying to fix the similar issue post upgrade to 2.3.5. Could you please look at my post and suggest a possible solution magento.stackexchange.com/questions/314451/… – CodeForGood Jun 8 at 4:32

You can add a domain to the whitelist for a policy (like script-src, style-src, font-src and others) by adding a csp_whitelist.xml to your custom module’s etc folder.

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
        <policy id="script-src">
                <value id="devdocs-base" type="host">https://devdocs.magento.com</value>
                <value id="magento" type="host">https://magento.com</value>
        <policy id="connect-src">
                <value id="devdocs" type="host">https://devdocs.magento.com</value>

From: https://devdocs.magento.com/guides/v2.3/extension-dev-guide/security/content-security-policies.html

Related: Magento 2.3.5 Content Security Policy false positive cdn fonts

| improve this answer | |
  • Thanks for your answer, in this case I'm mainly interested in the images/fonts/scripts with data:image/png;base64, data:application/javascript;base64, data:application/font-woff;base64 – Materix May 1 at 12:24
  • Do you need clear cache or something after doing this? It doesn't work for me – KaMZaTa May 1 at 12:50
  • It doesn't work for me. Did it work for you? I'm trying to whitelisting a script added in <head> through layout/default.xml file and placed in my_theme/web/js/myscript.js. It load the script but it is not whitelisted. – KaMZaTa May 1 at 13:35
  • 1
    @CodeForGood just disable the module: magento module:disable Magento_Csp – KaMZaTa Jun 11 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.