19

In regarding to CSP I create own csp_whitelist, but still I am getting:

The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com https://js.stripe.com/ https://www.googletagmanager.com/ https://www.google.com/ 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com https://stats.g.doubleclick.net/ data: 'self' 'unsafe-inline'; script-src assets.adobedtm.com js.authorize.net jstest.authorize.net secure.authorize.net test.authorize.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com js.braintreegateway.com s.ytimg.com video.google.com vimeo.com www.vimeo.com cdn-scripts.signifyd.com www.youtube.com https://js.stripe.com/v3/ https://www.googletagmanager.com/gtm.js https://www.google.com/recaptcha/api.js https://www.gstatic.com/ 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.

Can I fix it using csp_whitelist.xml?

Edit:
I tried to add some those domains as host to font-src, but it doesnt solve issue. I mean, domains didn`t disappear from warning

.

EDIT && Solutions:

For issue I wrote here (The Content Security Policy 'font-src 'self' 'unsafe-inline';). It is enough to set up report_uri in Your csp_whitelist.xml file.

For issue with data:xxx is enough to add 

<policy id="font-src">
    <values>
        <value id="data" type="host">data:</value>
    </values>
</policy>

to Your csp_whitelist.xml file.
Of course You should add data: policy depends on scope where You have problem (policy id should be changed for example to img-src etc).
It is necessary to set is as host, cause right now Magento doesn`t read any other types.

Improve this question
0

10 Answers 10

Reset to default
7

At the end of the console report, it says:

"...was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header."

This is not saying that the the domain values for each of the listed policies are not whitelisted, they are by default (this error made me believe they weren't until I really looked at it closer). It's saying that there is no report-uri directive.

From the devdocs, it says:

Regardless of restrict or report-only mode, CSP violations may be reported to an endpoint for collection. The URL to use for reporting by browsers can be configured in your custom module’s config.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront>
                    <report_uri>http://csp-reporting-service.com/my-project/endpoint</report_uri>
                </storefront>
                <admin>
                    <report_uri>http://csp-reporting-service.com/my-project/endpoint</report_uri>
                </admin>
            </mode>
        </csp>
    </default>
</config>

By default, CSP sends errors to the browser console, but can be configured to collect error logs by HTTP request. In addition, there are a number of third-party services that you can use to monitor, collect, and report CSP violations. So, either configure it to be reported to the error logs by https request, or create a custom module and configure the report_uri directive with the CSP reporting service of your liking. https://devdocs.magento.com/security/content-security-policy-overview.html

Improve this answer
8
  • Hey, thanks. I was not sure about that. I will not use report-uri for now so I couldn`t test it.
    – Konrad Siamro
    Commented May 7, 2020 at 5:53
  • 2
    I tested this today but could not get the report-uri config to work. One other way to resolve this is simply to disable the Magento_Csp module...
    – paj
    Commented May 7, 2020 at 18:19
  • @paj Disabling the module would certainly stop the reports in the console, however it's not a solution to the problem.
    – MagentoAaron
    Commented May 8, 2020 at 12:02
  • 2
    @MagentoAaron Depends if you want this feature or not - as a Magento Merchant I didn't ask for CSP to be implemented in Magento 2.3.5 - the option to disable it would have been nice!
    – paj
    Commented May 8, 2020 at 13:57
  • 1
    @Nagaraju K - The recommendation should be Restrict. But you'll have to set it to Report Only unless you have your Content Security Policy up-to-date and confirmed working. If you don't have it properly configured and you enable Restrict mode, then those resources would be blocked from loading.
    – MagentoAaron
    Commented Jul 10, 2020 at 19:06
26

Magento 2.3.5 p1 added a new module module-csp ( Magento_Csp ) which supports Content Security Policies ( CSP ) headers and provides ways to configure them. The policies can be configured for backend and frontend areas both.

Content Security Policies ( CSP ) has two modes – report-only and restrict. In Magento 2.3.5 p1, the default mode is report-only which is shows the policy violations in the browser's console. You can configure these csp for all third party loaded content as per your custom modules and theme.

I was able to solve all the policy errors for my site by creating a custom module.

app/code/Namespace/Csp/registration.php

<?php
    \Magento\Framework\Component\ComponentRegistrar::register(
        \Magento\Framework\Component\ComponentRegistrar::MODULE,
        'Namespace_Csp',
        __DIR__
    );

app/code/Namespace/Csp/etc/module.xml

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Namespace_Csp" setup_version="1.0.0" />
</config>

app/code/Namespace/Csp/etc/config.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront>
                    <report_uri>https://www.example.com/</report_uri>
                </storefront>
                <admin>
                    <report_uri>https://www.example.com/</report_uri>
                </admin>
            </mode>
            
        </csp>
    </default>
</config>

app/code/Namespace/Csp/etc/csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="google" type="host">*.google.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="klarna-base" type="host">*.klarna.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="youtube-img" type="host">*.ytimg.com</value>
                <value id="data" type="host">'self' data:</value>
                <value id="lightemporium" type="host">*.lightemporium.com</value>                
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
            </values>
        </policy>
        
        <policy id="frame-src">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
            </values>
        </policy>
        
        <policy id="form-action">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Add your thirdparty urls/domains to csp_whitelist.xml. All suggestions are most welcome

Improve this answer
4
  • 2
    how to set dynamic domain name in config.xml file as for my staging website it will be a different URL. you have hardcoded the domain - example.com
    – Sairaj Gadekar
    Commented Jul 4, 2020 at 14:10
  • 3
    Why the magento team did not deliver such a module, why do we have to create it ourselve??? And why is everything hardcoded, you should be able to configure it from the backend.
    – Black
    Commented Jul 16, 2020 at 13:55
  • Thanks for the module, please add <?php in the beginning of your app/code/Namespace/Csp/registration.php
    – SoCix
    Commented Nov 2, 2020 at 6:35
  • @suman What about multistore website? Can we use multiple storefront in config.xml
    – Nayem323
    Commented Mar 26, 2021 at 11:50
10

This worked for me:

https://maxchadwick.xyz/blog/magento-disable-csp

How To Disable Content Security Policy (CSP) The best way to disable Content Security Policy is to disable the Magento_Csp module:

php bin/magento module:disable Magento_Csp

Please read that article for more details

Improve this answer
1
  • 3
    This means that you are disabling a security feature and you enable cross site scripting attacks (XSS). You are supposed to whitelist the allowed domains and then set the extension from report only mode to restrict mode.
    – Black
    Commented Jun 29, 2020 at 8:43
2

to fix this issue please use this module - https://github.com/Anantkprajapati/AKP_CSP

Improve this answer
1

To whitelist data:font and data:application

    <policy id="font-src">
        <values>
            <value id="data" type="host">'self' data:</value>
        </values>
    </policy>

Hope it will help you.

Improve this answer
0

While you develop your own module for to fix the issue, you can disable Magento_Csp module, just to stop the show error on console. This will not fix the issue.

Improve this answer
0

I've created Magento 2 module to collect CSP reports and automatically generate rules to eliminate warning spam in browser console. You can try to use it - https://github.com/flancer32/mage2_ext_csp

This module does not add data: rule automatically at the moment. You need to add this rule manually (using SQL) directly to DB.

Improve this answer
0

This big message means you're in report-only CSP mode. Logically it assumes you have a report url to use this mode. If you don't have report uri, you can set the mode to restrict by adding this to your config.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront>
                    <report_only>0</report_only>
                </storefront>
                <admin>
                    <report_only>0</report_only>
                </admin>
            </mode>
        </csp>
    </default>
</config>

Resource https://devdocs.magento.com/guides/v2.4/extension-dev-guide/security/content-security-policies.html#configure-a-modules-csp-mode

Improve this answer
0

To clean up these errors you have to create a module and implement a file called etc/csp_whitelist.xml. In this file, you might be able to whitelist domains or files.

One of the things I didn't figure yet is how to whitelist data:font and data:application.

Improve this answer
3
  • 3
    I did it. You can do work around and put data: as host (instead of domain). Its not great, but its the only one way to fix errors with data:xxx right now. It is because magento csp_whitelist works only with host parameter.
    – Konrad Siamro
    Commented May 8, 2020 at 5:31
  • You cannot prevent the OP's specific report in the console with the etc/csp_whitelist.xml file. This specific report is a result of the report-uridirective not being configured.
    – MagentoAaron
    Commented May 8, 2020 at 12:06
  • @KonradSiamro thanks! I confirm, your method works.
    – Fred August
    Commented May 8, 2020 at 14:13
0

It has mentioned in 2.4.3 release Magento doc., this is still a known issue with Magento: https://devdocs.magento.com/guides/v2.4/release-notes/open-source-2-4-3.html#known-issues. So, we can do is a temporary fix for being time.

The solution is to creating own custom module to extending the Magento_Csp module. In the etc/config.xml file we want to modify the frame-ancestor policy and set it to 0.

<?xml version="1.0"?>
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
<default>
    <csp>
        <policies>
            <storefront>
                <frame-ancestors>
                    <inline>0</inline>
                </frame-ancestors>
            </storefront>
            <admin>
                <frame-ancestors>
                    <inline>0</inline>
                </frame-ancestors>
            </admin>
        </policies>
    </csp>
</default>

Then run:

bin/magento s:up
bin/magento c:f

This will help it's a working solution.

Happy Coding!!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.