Magento 2 - how to fix CSP module [Report Only] messages?

Question

I'm checking my website's error console and I see that there are errors in the console:

[Report Only] Refused to frame 'https://ct.pinterest.com/' because it violates the following Content Security Policy directive

I have already created the csp_whitelist.xml file and whitelisted this site but the message still exists.

<policy id="frame-src">
         <value id="pinterest" type="host">https://ct.pinterest.com</value>
</policy>

I don't want to disable the CSP module but I want to fix these errors in console. How can I do?

Answer 1

Try this

csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="frame-src">
            <values>
                <value id="ct.pinterest.com" type="host">ct.pinterest.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Answer 2

SOLUTION:

<policy id="frame-src">
            <value id="pinterest" type="host">pinterest.com</value>
            <value id="subpinterest" type="host">*.pinterest.com</value>
    </policy>

I hope this can help someone ;)

Answer 3

Added the following lines in csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="font-src">
            <values>
                <value id="cloudflare" type="host">*.pinterest.com</value>
                <value id="data" type="host">'self' data:</value>
                <value id="data" type="host">'unsafe-inline' data:</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>