Content security policies for custom modules can be added by setting up a csp_whitelist.xml file, i.e. app/code/Vendorname/Modulename/etc/cps_whitelist.xml, this is more or less excessively described in the docs.

However, the docs also mention

Configure CSPs for your custom code/extension/theme

Yet, I seem to be unable to get a working whitelist addition from within a custom theme, i.e. app/design/Vendorname/Themename/etc/cps_whitelist.xml?


<?xml version="1.0" encoding="UTF-8"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
        <policy id="style-src">
                <value id="fontsGoogleapisCom" type="host">fonts.googleapis.com</value>

This very same whitelist is working and brings me the expected result when moved to a custom module (i.e. app/code/Vendorname/ThemenameCsp).

Am I supposed to create a custom-theme-related custom module just to allow my custom theme to load an external font? Seems a bit nasty to me if that's actually the case.

1 Answer 1


Unless one may come up with a better solution, this is my workaround:

As it looks, we can just extend the theme's registration.php to register as a theme and as module (?!) to something like this:

use \Magento\Framework\Component\ComponentRegistrar;

ComponentRegistrar::register(ComponentRegistrar::THEME, 'frontend/Vendorname/Themename', __DIR__);
ComponentRegistrar::register(ComponentRegistrar::MODULE, 'Vendorname_Themename', __DIR__);

Now, once a etc/module.xml is in place we also can add a csp_whitelist.xml with the very same content as mentioned in the question above.

Note: As I am not sure whether this is the indented way to go I'll keep the question unanswered for the time being.

  • interesting solution - I like your thinking...
    – paj
    Commented Feb 1, 2021 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.