Refused to connect to because it violates the following Content Security Policy directive

Question

My js code: -

const MODEL_PATH = 'http://s3-us-west-2.amazonaws.com/s.cdpn.io/1376484/stacy_lightweight.glb';

The console is throwing an error:

Refused to connect to 'http://s3-us-west-2.amazonaws.com/s.cdpn.io/1376484/stacy_lightweight.glb' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.cardinalcommerce.com https://s3-us-west-2.amazonaws.com 'self' 'unsafe-inline'".

Answer 1

Description

As of version 2.3.5, Magento supports CSP headers and provides ways to configure them. (This functionality is defined in the Magento_Csp module.) Magento also provides default configurations at the application level and for individual core modules that require extra configuration. Policies can be configured for adminhtml and storefront areas separately to accommodate different use cases. Magento also permits configuring unique CSPs for specific pages.

CSP can work in two modes:

report-only - In this mode, Magento reports policy violations but does not interfere. This mode is useful for debugging. By default, CSP violations are written to the browser console, but they can be configured to be reported to an endpoint as an HTTP request to collect logs. There are a number of services that will collect, store, and sort your store’s CSP violations reports for you.

restrict mode - In this mode, Magento acts on any policy violations.

Solution

You have two options:

1. (Recommended way):
   Follow the very good guide here on how to create a custom Csp whitelist module
2. (If you aren't able to get all CSP whitelist to work):
   bin/magento module:disable Magento_Csp --clear-static-content
bin/magento setup:upgrade

NOTE: Disabling the module obviously removes this new secure functionality.

• Magento developer guide here: Content Security Policies