2

I created a whitelist for content-src CSP like this:

   <policy id="connect-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="freshrelevance" type="host">*.freshrelevance.com</value>
            <value id="ga" type="host">*.google-analytics.com</value>
        </values>
    </policy>

but the console log always shows this error:

[Report Only] Refused to connect to 'wss://am.freshrelevance.com/' because it violates the following Content Security Policy directive: "connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazonpay.com *.amazonpay.co.uk *.amazonpay.co.jp *.amazonpay.jp *.amazonpay.it *.amazonpay.fr *.amazonpay.es mws.amazonservices.com mws.amazonservices.co.uk mws.amazonservices.co.jp mws.amazonservices.jp mws.amazonservices.it mws.amazonservices.fr mws.amazonservices.es *.trackedlink.net *.trackedweb.net *.dotdigital-pages.com api.comapi.com webchat.dotdigital.com *.cloudflare.com *.freshrelevance.com *.google-analytics.com 'self' 'unsafe-inline'".

the others whitelisted just fine

4
  • what is the full link you are trying to access from connect-src="full-link" but are not allowed?
    – Kristoffer
    Commented Oct 22, 2020 at 3:26
  • @Kristoffer here is the link wss://am.freshrelevance.com/' Commented Oct 22, 2020 at 3:30
  • @TinyDancer, please tell me how did you fix it? Commented Jan 25, 2021 at 16:50
  • as this not https:// or http://, you will need to add full url to whitelist this wss://am.freshrelevance.com/ Commented May 24 at 7:03

3 Answers 3

3

Test to use the full link in your csp_whitelist.xml

<?xml version="1.0" encoding="UTF-8"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="connect-src">
            <values>
                <value id="freshrelevance" type="host">wss://am.freshrelevance.com/</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

It works fins in my case when I try:

<script>
    var ws = new WebSocket("wss://am.freshrelevance.com/");
</script>
1

I encountered similar challenges with Magento 2.4.7, where the checkout operates in restrict mode, while other pages are set to report-only mode. Interestingly, disabling the CSP module isn't an option, as it begins to generate errors when you run di compile command. I discovered a blog article that provided comprehensive details and proved instrumental in resolving the checkout issues I faced.

Create a custom module to implement Magento 2 CSP whitelisting

1. Create a custom module

  • Navigate to your Magento 2 root directory.
  • Create a new folder structure for your module, following the convention: app/code/VendorName/ModuleName. Replace VendorName with your developer name or company name. Replace ModuleName with a descriptive name for your module (e.g., CspWhitelist).

2. Create the etc Folder:

  • Inside the ModuleName folder, create a new folder named etc.

3. Create the csp_whitelist.xml File:

  • Within the etc folder, create a new file named csp_whitelist.xml.

4. Add Content to csp_whitelist.xml:

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
  <policies>
    <policy id="connect-src">
      <values>
        <value id="trusted-domain" type="host">wss://am.freshrelevance.com/</value>
      </values>
    </policy>
    </policies>
</csp_whitelist>

Explanation:

  • This code defines a whitelist for the connect-src policy. You can add additional policies like style-src and img-src following the same structure.
  • Add domain wss://am.freshrelevance.com/ you want to whitelist.
  • The id attribute for each value element specifies a unique identifier for the whitelist entry.
  • The type attribute defines the type of resource (e.g., host for entire domain, self for same-origin resources).
2
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – PY Yick
    Commented May 24 at 2:57
  • 1
    @PYYick - Thanks for the feedback, more information added :)
    – MageWizard
    Commented May 24 at 6:59
0

In your case, the application is trying to connect to 'wss://am.freshrelevance.com/', but this URL is not included in the connect-src directive of your CSP.

To fix this, you need to add 'wss://am.freshrelevance.com/' and '*.cardinalcommerce.com' to the connect-src directive in your CSP configuration.

You can add 'wss://am.freshrelevance.com/' and '*.cardinalcommerce.com' to the connect-src directive as below:

<?xml version="1.0" encoding="UTF-8"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="connect-src">
            <values>
                <value id="freshrelevance" type="host">wss://am.freshrelevance.com/</value>
                <value id="cardinalcommerce" type="host">*.cardinalcommerce.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.