0

We get a lot of [Report Only] Refused to load because it does not appear in the script-src directive of the Content Security Policy. errors in the browser console in the cart and in the checkout.

We already have a custom CSPWhitelist module, to whitelist the right domains. But the problem here is that it is our own domain.

It's also not theme related, because we have it also with default Luma theme.

For example:

[Report Only] Refused to load https://www.example.com/static/version1647099076/frontend/Theme/theme/en_EN/Magento_Checkout/js/view/cart/shipping-estimation.js because it does not appear in the script-src directive of the Content Security Policy.
[Report Only] Refused to load https://www.example.com/static/version1647246372/frontend/Magento/luma/nl_NL/knockoutjs/knockout.js because it does not appear in the script-src directive of the Content Security Policy.

We only face them on those two pages, category and product page are working fine.

These refused to load are all internal resources, like default Magento checkout JS files.

How can we solve this issue?

1
  • are you able to share your csp config file? Commented Sep 7, 2022 at 11:24

4 Answers 4

0

Can you please do this code for this. If you have an own module in the app/code then you must create the following file.

app/code/vendorname/modulename/etc/csp_whitelist.xml

First you can create csp_whitelist.xml

Copy below code in .xml file.

 <?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="google.co.in" type="host">*.google.co.in</value>
                <value id="facebook.com" type="host">*.facebook.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="connect-facebook" type="host">https://connect.facebook.net</value>
                <value id="connect-facebook-net" type="host">http://connect.facebook.net</value>
                <value id="paypalobjects" type="host">*.paypalobjects.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="chimpstatic" type="host">https://chimpstatic.com</value>
                <value id="googletagmanager" type="host">*.googletagmanager.com</value>
                <value id="youtube.com" type="host">*.youtube.com</value>
                <value id="s-adroll" type="host">https://s.adroll.com</value>
                <value id="s-adroll.com" type="host">http://s.adroll.com</value>
                <value id="d-adroll" type="host">https://d.adroll.com</value>
                <value id="adroll-mgr" type="host">https://d.adroll.mgr.consensu.org</value>
                <value id="bootstapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="mailmunch" type="host">http://a.mailmunch.co</value>
                <value id="gstatic.com" type="host">https://www.gstatic.com/recaptcha/</value>
                <value id="payment-amazon" type="host">*.payments-amazon.com</value>
                <value id="payment-amazon-co-uk" type="host">*.payments-amazon.co.uk</value>
                <value id="payment-amazon-co-jp" type="host">*.payments-amazon.co.jp</value>
                <value id="payment-amazon-jp" type="host">*.payments-amazon.jp</value>
                <value id="payment-amazon-it" type="host">*.payments-amazon.it</value>
                <value id="payment-amazon-fr" type="host">*.payments-amazon.fr</value>
                <value id="payment-amazon-es" type="host">*.payments-amazon.es</value>
                <value id="payment-amazon-de" type="host">*.payments-amazon.de</value>
                <value id="connect-podium" type="host">https://connect.podium.com</value>
                <value id="stats-doubleclick" type="host">https://stats.g.doubleclick.net</value>
                <value id="www.shopperapproved.com" type="host">http://www.shopperapproved.com</value>
                <value id="ajax.googleapis.com" type="host">https://ajax.googleapis.com</value>
                <value id="seal.geotrust.com" type="host">https://seal.geotrust.com</value>
                <value id="scontent.webcollage.net" type="host">https://scontent.webcollage.net</value>
                <value id="syndi.webcollage.net" type="host">https://syndi.webcollage.net</value>
                <value id="content.syndigo.com" type="host">https://content.syndigo.com</value>
                <value id="cdn1.affirm.com" type="host">https://cdn1.affirm.com</value>
                <value id="sync.taboola.com" type="host">https://sync.taboola.com</value>
                <value id="image2.pubmatic.com" type="host">https://image2.pubmatic.com</value>

            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="google.co.in" type="host">*.google.co.in</value>
                <value id="facebook.com" type="host">*.facebook.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="youtube.com" type="host">*.youtube.com</value>
                <value id="bootstapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="connect-podium" type="host">https://connect.podium.com</value>
                <value id="mailmunch" type="host">http://a.mailmunch.co</value>
                <value id="sync.taboola.com" type="host">https://sync.taboola.com</value>
                <value id="image2.pubmatic.com" type="host">https://image2.pubmatic.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="google.co.in" type="host">*.google.co.in</value>
                <value id="facebook.com" type="host">https://www.facebook.com</value>
                <value id="klarna-base" type="host">*.klarna.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
                <value id="youtube-img" type="host">*.ytimg.com</value>
                <value id="data" type="host">'self' data:</value>
                <value id="lightemporium" type="host">*.lightemporium.com</value>                
                <value id="usercentrics" type="host">*.usercentrics.eu</value>
                <value id="connect-base" type="host">*.connect.facebook.net</value>
                <value id="stats-doubleclick" type="host">https://stats.g.doubleclick.net</value>
                <value id="youtube.com" type="host">*.youtube.com</value>
                <value id="adobe" type="host">*.adobe.com</value>
                <value id="d-adroll" type="host">https://d.adroll.com</value>
                <value id="pixel-advertising" type="host">https://pixel.advertising.com</value>
                <value id="pixel-rubiconproject" type="host">https://pixel.rubiconproject.com</value>
                <value id="simage2-pubmatic" type="host">https://simage2.pubmatic.com</value>
                <value id="dsum-sec-casalemedia" type="host">https://dsum-sec.casalemedia.com</value>
                <value id="ads-yahoo" type="host">https://ads.yahoo.com</value>
                <value id="eb2-3lift" type="host">https://eb2.3lift.com</value>
                <value id="sync-outbrain" type="host">https://sync.outbrain.com</value>
                <value id="trc-taboola" type="host">https://trc.taboola.com</value>
                <value id="x-bidswitch" type="host">https://x.bidswitch.net</value>
                <value id="ib-adnxs" type="host">https://ib.adnxs.com</value>
                <value id="idsync-rlcdn" type="host">https://idsync.rlcdn.com</value>
                <value id="us-u-openx" type="host">https://us-u.openx.net</value>
                <value id="ups-analytics-yahoo" type="host">https://ups.analytics.yahoo.com</value>
                <value id="segments-company-target" type="host">https://segments.company-target.com</value>
                <value id="x-bidswitch" type="host">https://x.bidswitch.net/sync</value>
                <value id="ib-adnxs" type="host">https://ib.adnxs.com</value>
                <value id="idsync-rlcdn" type="host">https://idsync.rlcdn.com</value>
                <value id="us-u-openx" type="host">https://us-u.openx.net</value>
                <value id="ups-analytics-yahoo" type="host">https://ups.analytics.yahoo.com</value>
                <value id="segments-company-target" type="host">https://segments.company-target.com</value>
                <value id="sync-tidaltv" type="host">https://sync.tidaltv.com</value>
                <value id="assets.podium.com" type="host">https://assets.podium.com</value>
                <value id="www.shopperapproved.com" type="host">http://www.shopperapproved.com</value>
                <value id="event.webcollage.net" type="host">https://event.webcollage.net</value>
                <value id="event.syndigo.cloud" type="host">https://event.syndigo.cloud</value>
                <value id="content.syndigo.com" type="host">https://content.syndigo.com</value>
                <value id="sync.taboola.com" type="host">https://sync.taboola.com</value>
                <value id="image2.pubmatic.com" type="host">https://image2.pubmatic.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="paypal" type="host">*.paypal.com</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="google.co.in" type="host">*.google.co.in</value>
                <value id="facebook.com" type="host">*.facebook.com</value>
                <value id="forms.mailmunch.co" type="host">http://forms.mailmunch.co</value>
                <value id="mind-flayer.podium.com" type="host">https://mind-flayer.podium.com</value>
                <value id="mailmunch" type="host">http://a.mailmunch.co</value>
                <value id="stats-doubleclick" type="host">https://stats.g.doubleclick.net</value>
                <value id="d-adroll" type="host">https://d.adroll.com</value>
                <value id="www.affirm.com" type="host">https://www.affirm.com</value>
                <value id="tracker.affirm.com" type="host">https://tracker.affirm.com</value>
                <value id="content.syndigo.com" type="host">https://content.syndigo.com</value>
                
                <value id="sync.taboola.com" type="host">https://sync.taboola.com</value>
                <value id="image2.pubmatic.com" type="host">https://image2.pubmatic.com</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google.com" type="host">*.google.com</value>
                <value id="google.co.in" type="host">*.google.co.in</value>
                <value id="facebook.com" type="host">*.facebook.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="twimg" type="host">*.twimg.com</value>
                <value id="trustedshops" type="host">*.trustedshops.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="bootstapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="connect-podium" type="host">https://connect.podium.com</value>
                <value id="sync.taboola.com" type="host">https://sync.taboola.com</value>
                <value id="image2.pubmatic.com" type="host">https://image2.pubmatic.com</value>
            </values>
        </policy>

        <policy id="frame-src">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="google.com" type="host">https://www.google.com</value>
                <value id="google.co.in" type="host">https://www.google.co.in</value>
                <value id="facebook.com" type="host">https://www.facebook.com</value>
                <value id="www.affirm.com" type="host">https://www.affirm.com</value>
            </values>
        </policy>

        <policy id="form-action">
            <values>
                <value id="twitter.com" type="host">*.twitter.com</value>
                <value id="facebook.com" type="host">*.facebook.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>
4
  • Thanks! Sadly that did not solve the issue. Because the main problem is that it does not allow our own domain. For example we get the following error: [Report Only] Refused to load https://www.example.com/static/version1647246372/frontend/Magento/luma/nl_NL/knockoutjs/knockout.js because it does not appear in the script-src directive of the Content Security Policy.
    – JGeer
    Commented Mar 14, 2022 at 8:27
  • Contact your server guy for this because may be it's block script-src from server side. IF it's come in localhost ? then discussion more. Commented Mar 14, 2022 at 11:33
  • Thanks! It's coming in localhost. And we only face this issue in the checkout section, so in the cart and checkout itself. It works without any issue on the product, category and cms pages.
    – JGeer
    Commented Mar 14, 2022 at 14:21
  • try adding self instead of host as "type"
    – MageWizard
    Commented May 24 at 8:56
0

Magento 2.4 comes with a module for regulating the resources loaded by the site using content security policy headers or CSP. As I can see the "errors" you are getting are not exactly errors but warning as it is in report-only mode. The module by default validates the domain and rules for which it is not whitelisted with Content-Security-Policy-Report-Only header and reports them, but doesn't block them.

Now, the issue might be with your custom CSPWhitelist module or you may have wrongly correlated the issue with this error message and this error message would be appearing in rest of the pages of the store too.

References:

You can read up more about Content Security Policy headers here

You can also know more about the module itself from Magento devdocs here

0

You can disable the extension and then try to check it

Magento_Csp => '0'

From config.php

OR from the cmd

php bin/magento module:disable --clear-static-content Magento_Csp
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento setup:static-content:deploy
php bin/magento cache:flush
2
  • Thanks! But that only disable the core M2 module, that's not exactly what we want. We want to solve the issue.
    – JGeer
    Commented Mar 21, 2022 at 9:40
  • ok, I will update my answer, after researching on it. Commented Mar 21, 2022 at 10:48
0

Try to adding 'self' as type in the csp_whitelist.xml

<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
  <policies>
    <policy id="script-src">
      <values>
        <value id="trusted-domain" type="self">https://www.example.com</value>
      </values>
    </policy>
    </policies>
</csp_whitelist>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.