My js code: -

const MODEL_PATH = 'http://s3-us-west-2.amazonaws.com/s.cdpn.io/1376484/stacy_lightweight.glb';

The console is throwing an error:

Refused to connect to 'http://s3-us-west-2.amazonaws.com/s.cdpn.io/1376484/stacy_lightweight.glb' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.cardinalcommerce.com https://s3-us-west-2.amazonaws.com 'self' 'unsafe-inline'".

1 Answer 1



As of version 2.3.5, Magento supports CSP headers and provides ways to configure them. (This functionality is defined in the Magento_Csp module.) Magento also provides default configurations at the application level and for individual core modules that require extra configuration. Policies can be configured for adminhtml and storefront areas separately to accommodate different use cases. Magento also permits configuring unique CSPs for specific pages.

CSP can work in two modes:

report-only - In this mode, Magento reports policy violations but does not interfere. This mode is useful for debugging. By default, CSP violations are written to the browser console, but they can be configured to be reported to an endpoint as an HTTP request to collect logs. There are a number of services that will collect, store, and sort your store’s CSP violations reports for you.

restrict mode - In this mode, Magento acts on any policy violations.


You have two options:

  1. (Recommended way):
    Follow the very good guide here on how to create a custom Csp whitelist module
  2. (If you aren't able to get all CSP whitelist to work):
    bin/magento module:disable Magento_Csp --clear-static-content
    bin/magento setup:upgrade

NOTE: Disabling the module obviously removes this new secure functionality.

  • Thank you.This works for me. Commented May 29, 2020 at 9:33
  • Pleasure, good luck! Commented May 29, 2020 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.