Frontend error after upgrade to Magento 2.4.7 Error: Cannot instantiate interface Magento\Csp\Model\Collector\MergerInterface

Question

After performing a test upgrade from Magento Open Source 2.4.6 to 2.4.7 the frontend does not load returning the error

Error: Cannot instantiate interface Magento\Csp\Model\Collector\MergerInterface in /var/www/magento2/vendor/magento/framework/ObjectManager/Factory/AbstractFactory.php:121

setup:upgrade completes without errors

setup:di:compile completes without errors

No further errors found in log files

Backend / Administration is working fine

Answer 1

This issue is occurring because you disabled or removed the Magento_Csp module. Magento_Checkout, Magento_Paypal, and Magento_AdminAnalytics in Magento 2.4.7 and the latest security patches requires the Magento_Csp module. https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/magento-open-source/2-4-7

Changes to Content Security Policy (CSP)— Configuration updates and enhancements to Adobe Commerce Content Security Policies (CSPs) to comply with PCI 4.0 requirements.

If you unconcerned about CSP and PCI 4.0, you can reinstall/reenable the Magento_Csp module and disable the CSP for inline scripts.

The <your_module_path>/etc/config.xml should look like this:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <policies>
                <admin_sales_order_create_index>
                    <scripts>
                        <inline>1</inline>
                    </scripts>
                </admin_sales_order_create_index>
                <storefront_checkout_index_index>
                    <scripts>
                        <inline>1</inline>
                    </scripts>
                </storefront_checkout_index_index>
            </policies>
        </csp>
    </default>
</config>

Alternatively, you can install the CSP shim module by Pieter Hoste (hostep), a well-know Magento contributor. This module replaces the default Magento CSP module and effectively disables its functionality. https://github.com/baldwin-agency/magento2-module-csp-shim

However, for those concerned about CSP and PCI 4.0, try resolving the inline script issue using the instructions to "Whitelist an inline script or style" in the official documentation at https://developer.adobe.com/commerce/php/development/security/content-security-policies/#whitelist-an-inline-script-or-style

Answer 2

If you are not using the PayPal payment method then please disable the extension using the following command:

php bin/magento module:disable Magento_Csp

After disabling this extension then the error will not come.

Answer 3

The same problem is after upgrade from magento 2.4.5-p7 to magento 2.4.5-p8. When you have disabled CSP module, deploymet will go smoothly, but you will see maintenance page on the FrontEnd. In our case we can not enable CSP module, so we had to revert the version of app in composer.json to 2.4.7-p7 version in this way :

    "magento/magento-cloud-metapackage": ">=2.4.5 <2.4.6",
    "magento/magento2-base" : "2.4.5-p7",

With only the first line, magento will still download p8, even, when you will lock the metapackage strict to 2.4.5-7 it will not find it, and not build composer.lock. So the second line was the answer.

Answer 4

Sometimes enabling Magento_Csp introduce more issues in checkout. In that scenario you can change the CSP mode for checkout pages to "report-only" and disable inline script blocking for checkout pages. You need to add the following to etc/config.xml

    <?xml version="1.0"?>

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront_checkout_index_index>
                    <report_only>1</report_only>
                </storefront_checkout_index_index>
            </mode>
            <policies>
                <storefront_checkout_index_index>
                    <scripts>
                        <inline>1</inline>
                    </scripts>
                </storefront_checkout_index_index>
            </policies>
        </csp>
    </default>
</config>

Answer 5

Disable content security in magento 2.4.7

1. module/etc/frontend/events.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="controller_front_send_response_before">
        <observer name="csp_render" instance="Magento\Csp\Observer\Render" disabled="true" />
    </event>
</config>

2. etc/adminhtml/events.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="controller_front_send_response_before">
        <observer name="csp_render" instance="Magento\Csp\Observer\Render" disabled="true" />
    </event>
</config>

Answer 6

You can bypass the Magento_CSP by using the around plugin:

Create your di.xml in any custom module

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <type name="Magento\Csp\Observer\Render">
        <plugin name="ByPassCSPValidation" type="Vendor_Module\Plugin\ByPassCSPValidation" />
    </type>
</config>

Create a Plugin Vendor\Module\Plugin\ByPassCSPValidation

<?php

namespace Vendor\Module\Plugin;

use Magento\Csp\Observer\Render;

class ByPassCSPValidation
{
    public function aroundExecute(Render $subject, callable $proceed)
    {
       // Do nothing
    }
}

Thanks