Magento 2: Content Security Policy disabled, still get errors

Question

So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml

All fine and dandy but then I stumbled upon this blog post and concluded it might be smarter to disable this feature for the moment.

I completely disabled the Magento_Csp module. But in the console I still get all the CSP warnings and errors:

Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified
Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified
Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified
Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified

And so on. Shouldn't these messages be gone?

During checkout this one pops up as well:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

It refers to this script:

https://www.paypalobjects.com/web/res/30b/42656ce426a9d524a73c137e72027/js/lib/jquery.min.js

I assume this was triggered by the paypal plus module I installed.

Question is: why is magento still blocking it and keeps pesting me with warnings even though I removed the CSP module entirely?

Thank you

EDIT: Even though the console says otherwise, the network log shows that the file does get loaded properly (code 200).

Answer 1

I was also facing same issue. In my case it was the issue of nginx header. If you or anyone who is facing this issue make sure whether your nginx/apache etc is not including the header against the url which is throwing CSP error in console.

It will be like add_header for URL which you are getting CSP in console of browser.

Thank You!

Abbas