I created a new module to allow urls, and have them not make noise about csp.

I have a csp_whitelist file under /etc, and I've added all of my links to it (and cleared the cache), but the warnings are all still there.

I've tried with and without *. before the urls, and that didn't make a difference

here's a sample of the file:

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
        <policy id="style-src">
               <value id="zendesk-main" type="host">static.zdassets.com</value>
               <value id="fontawesome" type="host">fontawesome.com</value>
               <value id="google-font" type="host">fonts.googleapis.com</value>
               <value id="bootstrap-cdn" type="host">maxcdn.bootstrapcdn.com</value>
  • did you find a solution? I'm in your same situation :( it's frustrating.
    – Donato P
    Jul 16, 2020 at 18:00

1 Answer 1


What ended up working for me was removing the prefixes on the urls. For example,

instead of <value id="google-font" type="host">fonts.googleapis.com</value>,

I did <value id="google-font" type="host">googleapis.com</value>

Also, check the console for the errors you're getting, and add them to the list one by one, and make sure that they're in the correct policy block.

              <value id="google-font>url</value>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.