2

I'm checking my website's error console and I see that there are errors in the console:

[Report Only] Refused to frame 'https://ct.pinterest.com/' because it violates the following Content Security Policy directive

I have already created the csp_whitelist.xml file and whitelisted this site but the message still exists.

<policy id="frame-src">
         <value id="pinterest" type="host">https://ct.pinterest.com</value>
</policy>

I don't want to disable the CSP module but I want to fix these errors in console. How can I do?

3 Answers 3

2

Try this

csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="frame-src">
            <values>
                <value id="ct.pinterest.com" type="host">ct.pinterest.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>
1
  • I tried man but unfortunately with same result... :( How can i do?
    – Jackom
    Apr 21, 2023 at 9:10
2

SOLUTION:

<policy id="frame-src">
            <value id="pinterest" type="host">pinterest.com</value>
            <value id="subpinterest" type="host">*.pinterest.com</value>
    </policy>

I hope this can help someone ;)

1

Added the following lines in csp_whitelist.xml

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="font-src">
            <values>
                <value id="cloudflare" type="host">*.pinterest.com</value>
                <value id="data" type="host">'self' data:</value>
                <value id="data" type="host">'unsafe-inline' data:</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.