Magento 2 - CSP whitelist not work for subdomain

Question

I have whitelisted all the resources that come from facebook inside the csp_whitelist.xml file and for my main domain: www.magento2.com works without problems.

But for my subdomains the csp_whitelist does not work and in fact in the error console it says that the facebook resources have been blocked. This is my code:

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="font-src">
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="style-src">
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="frame-src">
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="script-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

How come the csp_whitelist.xml doesn't work for my subdomain.magento2.com subdomain?

Thank you

Answer 1

I've used the following format found on this post and it's working on M2.4. I hope it solves your issues too.

I was having several issues with Microsoft Clarity because they tend to use multiple subdomains on their scripts (i.e. https://a.clarity.ms or https://j.clarity.ms).

I ended up using one with the main domain and one with wildcard as suggested on the post and no issues so far. I guess it should work with the facebook domain too.

<value id="clarity.ms" type="host">clarity.ms</value>
<value id="wildcard.clarity.ms" type="host">*.clarity.ms</value>