0

I just configured cloudfront to have a CDN for static files and media, but there's a big problem.

As soon as I entered the links to the CDN in the Magento 2 back office, no more CSS / JS / image files are displayed or executed.

I assume this is from the CSP module that was added. However my question is: How do we get the cloudfront not to be blocked like this?

Do we really have to create a module specifically for this? Didn't they think about those who use CDN as cloudfront?

Thank you in advance for your answer.

1 Answer 1

2

For me, the only solution was to add a module for CSP exceptions.

app/code/mycompany/Csp

in the /etc dir, add a file called csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
               
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
               
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
                
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
              
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
          
            </values>
        </policy>

        <policy id="frame-src">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
            
            </values>
        </policy>

        <policy id="media-src">
            <values>
         
            </values>
        </policy>

        <policy id="form-action">
            <values>
                <value id="your-cdn" type="host">your-cdn-url</value>
             
            </values>
        </policy>
    </policies>
</csp_whitelist>
2
  • Still that the only way? Is there a way to accept everything from my subdomain? Instead use for example: font-src, connect-src etc?
    – jefferson
    May 14, 2021 at 17:46
  • Not that I know of. There needs to be an individual policy for everything
    – web master
    May 20, 2021 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.