The CSP directive 'frame-ancestors' does not support the source expression ''unsafe-inline''

Question

I can't succeed to make this error messages removed from my M 2.4

I did my custom csp module, everything works fine except this one

The Content-Security-Policy directive 'frame-ancestors' does not support the source expression ''unsafe-inline''

I did tried the following fix. But nothing worked

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
<default>
    <csp>
        <mode>
            <storefront>
                <report_only>0</report_only>
            </storefront>
            <admin>
                <report_only>0</report_only>
            </admin>
        </mode>
        <policies>
            <storefront>
                <frame-ancestors>
                    <inline>0</inline>
                </frame-ancestors>
            </storefront>
        </policies>
    </csp>
</default>
</config>

Answer 1

It has mentioned in 2.4.3 release Magento doc., this is still a known issue with Magento: https://devdocs.magento.com/guides/v2.4/release-notes/open-source-2-4-3.html#known-issues. So, we can do is a temporary fix for being time. It's occurs due to php version 7.4.

The solution is to creating own custom module to extending the Magento_Csp module. In the etc/config.xml file we want to modify the frame-ancestor policy and set it to 0.

use Below code:

0 0

After run that command :

It has mentioned in 2.4.3 release Magento doc., this is still a known issue with Magento: https://devdocs.magento.com/guides/v2.4/release-notes/open-source-2-4-3.html#known-issues. So, we can do is a temporary fix for being time.

The solution is to creating own custom module to extending the Magento_Csp module. In the etc/config.xml file we want to modify the frame-ancestor policy and set it to 0.

0 0 Then run:

bin/magento s:up bin/magento s:s:d -f bin/magento c:f