0

I have whitelisted all the resources that come from facebook inside the csp_whitelist.xml file and for my main domain: www.magento2.com works without problems.

But for my subdomains the csp_whitelist does not work and in fact in the error console it says that the facebook resources have been blocked. This is my code:

<?xml version="1.0"?>
<!--
/**
 * Copyright  Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="font-src">
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="style-src">
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="frame-src">
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="magento2com" type="host">*.magento2.com</value>
        </policy>
        <policy id="script-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="facebookcom" type="host">www.facebook.com</value>
                <value id="facebookweb" type="host">web.facebook.com</value>
                <value id="facebookconnect" type="host">connect.facebook.net</value>
                <value id="magento2com" type="host">*.magento2.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

How come the csp_whitelist.xml doesn't work for my subdomain.magento2.com subdomain?

Thank you

1
  • Any help for this?
    – Jackom
    Feb 24, 2022 at 9:24

1 Answer 1

0

I've used the following format found on this post and it's working on M2.4. I hope it solves your issues too.

I was having several issues with Microsoft Clarity because they tend to use multiple subdomains on their scripts (i.e. https://a.clarity.ms or https://j.clarity.ms).

I ended up using one with the main domain and one with wildcard as suggested on the post and no issues so far. I guess it should work with the facebook domain too.

<value id="clarity.ms" type="host">clarity.ms</value>
<value id="wildcard.clarity.ms" type="host">*.clarity.ms</value>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.