Upgrade to 2.3.5 and now getting this error bellow thought out the site on every page:

[Report Only] Refused to load the image 'blob:http://my.domayn.com/axxxxxxxxxxxx' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'".

Is anyone facing the same issue?


As of version 2.3.5, Magento supports Content Security Policy headers and provides ways to configure them.

Content Security Policies (CSP) are a powerful tool to mitigate against Cross Site Scripting (XSS) and related attacks, including card skimmers, session hijacking, clickjacking, and more.

By default, Content Security Policiy is configured in report-only mode, which allows merchants and developers to configure policies to work according to their custom code.

Your browser is not showing a Magento 2 error, it is reporting a CSP policy violation

You can configure your own custom CSP rules by adding a csp_whitelist.xml to a custom module etc folder.

You can find more information on how to do this here.


To completely disable CSP you can also try

bin/magento module:disable Magento_Csp
| improve this answer | |
  • 3
    Hi @paj In fresh magento2.3.5-p1, I am having the same issue So what I need to whitelist for fresh Magento. – Noshad May 4 at 6:59
  • Great answer. Thanks for the info. – andy jones May 4 at 16:48
  • This covers custom module, what about Magento's core modules? These reports are showing up for fresh installation of Magento. – MagentoAaron May 5 at 12:23
  • Why does the magento team not whitelist their own stuff for a fresh magento 2 ?? – Black Jul 21 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.