2

I'm trying to set the CSP whitelist for Magento. I tried in many ways but I'm not able to make it works.

The module is enabled but csp_whitelist.xml seems like ignored. After changed the file I run, of course, setup:upgrade and I cleared the cache.

My configuration:

  • Magento 2.4.0 in Developer mode served by Apache
  • Varnish Cache in front of Apache
  • Nginx as reverse proxy and SSL Termination in front of Varnish

The CSP module

This is the app/code/Vendor/Module/ I created:

registration.php

<?php

\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    'Vendor_Module',
    __DIR__
);

etc/module.xml

<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Vendor_Module" setup_version="1.0.0"/>
</config>

etc/config.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront>
                    <report_uri></report_uri>
                    <report_only>1</report_only>
                </storefront>
                <admin>
                    <report_uri></report_uri>
                    <report_only>1</report_only>
                </admin>
            </mode>
        </csp>
    </default>
</config>

etc/csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="default-src">
            <values>
                <value id="paypal" type="host">*.paypal.com</value>
            </values>
        </policy>
        <policy id="script-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="googletagmanager.com" type="host">googletagmanager.com</value>
                <value id="google" type="host">*.google.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="addthis.com" type="host">*.addthis.com</value>
                <value id="s7.addthis.com" type="host">s7.addthis.com</value>
                <value id="m.addthis.com" type="host">m.addthis.com</value>
                <value id="addthis-analytics" type="host">z.moatads.com</value>
                <value id="addthis-cdn" type="host">*.addthisedge.com</value>
                <value id="googleapis" type="host">apis.google.com</value>
                <value id="graph-facebook" type="host">graph.facebook.com</value>
                <value id="widgets-pinterest" type="host">widgets.pinterest.com</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="fontawesomecdn" type="host">*.bootstrapcdn.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="data" type="host">'self' data:</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="fontawesomecdn" type="host">*.bootstrapcdn.com</value>
            </values>
        </policy>

        <policy id="frame-src">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="addthis.com" type="host">*.addthis.com</value>
            </values>
        </policy>

        <policy id="form-action">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Any Ideas?

1 Answer 1

2

You can refer below a useful module or use and try it might help you.

Module Link

With that, you can get CSP Violations Reports and you can eliminate accordingly.

3
  • Thanks, it seems to be a great module but it still doesn't work. It seems to be ignored this too. I got the same console errors, nothing less, nothing more.
    – KaMZaTa
    Sep 17, 2020 at 10:24
  • Sorry! I forgot to run magento fl32:csp:analyze! Now it seems to partially work!
    – KaMZaTa
    Sep 17, 2020 at 10:37
  • How can I add more rules? Running magento fl32:csp:analyze recognized almost all entries except one. How can I add it?
    – KaMZaTa
    Sep 17, 2020 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.