6

I am trying to get my head around csp after upgrading Magento to 2.4.7. Prior to this, it was disabled. I have installed a custom module successfully and added a csp_whitelist.xml file with the following that I copied off a whitelist on github:

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="default-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="base-uri">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="data" type="host">'self' data: https://maxcdn.bootstrapcdn.com</value>
                <value id="bootstrapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="data" type="host">'report-sample'</value>
                <value id="data2" type="host">'self'</value>
                <value id="data3" type="host">'unsafe-inline'</value>
                <value id="data4" type="host">https://maxcdn.bootstrapcdn.com</value>
                <value id="bootstrapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="google-apis" type="host">*.googleapis.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="adobedtm-assets" type="host">assets.adobedtm.com</value>
                <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="google-maps" type="host">'self' https://maps.googleapis.com</value>
            </values>
        </policy>
        <policy id="frame-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="stripe" type="host">https://js.stripe.com</value>
                <value id="google" type="host">*.google.com</value>
            </values>
        </policy>
        <policy id="script-src">
            <values>
                <value id="hash" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value>
                <value id="hash2" type="hash" algorithm="sha256">3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=</value>
                <value id="hash3" type="hash" algorithm="sha256">2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=</value>
                <value id="hash4" type="hash" algorithm="sha256">p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=</value>
                <value id="hash5" type="hash" algorithm="sha256">0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=</value>
                <value id="hash6" type="hash" algorithm="sha256">nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=</value>
                <value id="report-sample" type="host">'report-sample'</value>
                <value id="self" type="host">'self'</value>
                <value id="unsafe-eval" type="host">'unsafe-eval'</value>
                <value id="unsafe-hashes" type="host">'unsafe-hashes'</value>
                <value id="unsafe-inline" type="host">'unsafe-inline'</value>
                <value id="adobedtm-assets" type="host">assets.adobedtm.com</value>
                <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                <value id="adobe" type="host">*.adobe.com</value>
                <value id="avada" type="host">*.avada.io</value>
                <value id="amcglobal" type="host">amcglobal.sc.omtrdc.net</value>
                <value id="braintree-api" type="host">api.braintreegateway.com</value>
                <value id="braintree-sandbox" type="host">api.sandbox.braintreegateway.com</value>
                <value id="braintree-analytics" type="host">client-analytics.braintreegateway.com</value>
                <value id="braintree-analytics-sand" type="host">client-analytics.sandbox.braintreegateway.com</value>
                <value id="braintree-js" type="host">js.braintreegateway.com</value>
                <value id="braintree-assets" type="host">assets.braintreegateway.com</value>
                <value id="cardinalcommerce" type="host">geostag.cardinalcommerce.com</value>
                <value id="cardinalcommerce2" type="host">1eafstag.cardinalcommerce.com</value>
                <value id="cardinalcommerce3" type="host">geoapi.cardinalcommerce.com</value>
                <value id="cardinalcommerce4" type="host">1eafapi.cardinalcommerce.com</value>
                <value id="cardinalcommerce5" type="host">songbird.cardinalcommerce.com</value>
                <value id="cardinalcommerce6" type="host">*.cardinalcommerce.com</value>
                <value id="cardinalcommerce7" type="host">songbirdstag.cardinalcommerce.com</value>
                <value id="commerce-payment8" type="host">*.commerce-payment-services.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="google-pay" type="host">pay.google.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="google-analytics2" type="host">www.google-analytics.com</value>
                <value id="google-analytics3" type="host">analytics.google.com</value>
                <value id="google-analytics4" type="host">analytics.google.com</value>
                <value id="googletagmanager" type="host">googletagmanager.com</value>
                <value id="googletagmanager2" type="host">www.googletagmanager.com</value>
                <value id="googletagmanager3" type="host">*.googletagmanager.com</value>
                <value id="google-apis" type="host">apis.google.com</value>
                <value id="google-apis2" type="host">*.googleapis.com</value>
                <value id="google-apis3" type="host">www.googleapis.com</value>
                <value id="google-ads" type="host">www.googleadservices.com</value>
                <value id="google-ads2" type="host">googleads.g.doubleclick.net</value>
                <value id="google-ads3" type="host">*.googleadservices.com</value>
                <value id="google-ads4" type="host">googleads.g.doubleclick.net</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="google-recaptcha" type="host">https://www.gstatic.com/recaptcha/</value>
                <value id="google-recaptcha2" type="host">https://www.google.com/recaptcha/</value>
                <value id="google-recaptcha3" type="host">www.google.com/recaptcha/</value>
                <value id="google-recaptcha4" type="host">www.gstatic.com/recaptcha/</value>
                <value id="google-recaptcha5" type="host">https://www.gstatic.com/recaptcha</value>
                <value id="google-recaptcha6" type="host">https://www.google.com/recaptcha</value>
                <value id="google" type="host">google.com</value>
                <value id="google2" type="host">*.google.com</value>
                <value id="google3" type="host">*.google.com/</value>
                <value id="google-maps" type="host">https://maps.googleapis.com/maps/api/js</value>
                <value id="includestest" type="host">includestest.ccdc02.com</value>
                <value id="instagram" type="host">*.instagram.com</value>
                <value id="klarna" type="host">klarna.com</value>
                <value id="klarna2" type="host">*.klarna.com</value>
                <value id="klarna3" type="host">*.klarnacdn.net</value>
                <value id="klarna4" type="host">*.klarnaevt.com</value>
                <value id="magento-ds" type="host">*.magento-ds.com</value>
                <value id="newrelic" type="host">*.newrelic.com</value>
                <value id="nr-data" type="host">*.nr-data.net</value>
                <value id="paypal" type="host">www.paypal.com</value>
                <value id="paypal-objects" type="host">www.paypalobjects.com</value>
                <value id="paypal-objects2" type="host">*.paypalobjects.com</value>
                <value id="paypal-t" type="host">t.paypal.com</value>
                <value id="paypal-c" type="host">c.paypal.com</value>
                <value id="paypal-all" type="host">*.paypal.com</value>
                <value id="paypal-sandbox" type="host">www.sandbox.paypal.com</value>
                <value id="paypal-sandbox2" type="host">sandbox.paypal.com</value>
                <value id="paypal-sandbox3" type="host">*.sandbox.paypal.com</value>
                <value id="paypal-t2" type="host">t.paypal.com</value>
                <value id="stripe-js" type="host">https://js.stripe.com/v3/</value>
                <value id="stripe-all" type="host">*.stripe.com</value>
                <value id="stripe-link" type="host">*.link.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="typekit2" type="host">use.typekit.net</value>
                <value id="vimeo" type="host">*.vimeo.com</value>
                <value id="vimeo2" type="host">www.vimeo.com</value>
                <value id="vimeo3" type="host">*.vimeocdn.com</value>
                <value id="youtube" type="host">*.youtube.com</value>
                <value id="ytimg" type="host">s.ytimg.com</value>
            </values>
        </policy>
        <policy id="media-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="manifest-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="object-src">
            <values>
                <value id="data" type="host">'none'</value>
                <value id="hash" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value>
                <value id="hash2" type="hash" algorithm="sha256">3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=</value>
                <value id="hash3" type="hash" algorithm="sha256">2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=</value>
                <value id="hash4" type="hash" algorithm="sha256">p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=</value>
                <value id="hash5" type="hash" algorithm="sha256">0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=</value>
                <value id="hash6" type="hash" algorithm="sha256">nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=</value>
            </values>
        </policy>
        <policy id="worker-src">
            <values>
                <value id="data" type="host">'none'</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

Currently my checkout is not loading, with Chrome's console giving me the following:

checkout/:11 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com www.googleapis.com *.vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.commerce-payment-services.com *.typekit.net google.com *.google.com amcglobal.sc.omtrdc.net *.magento-ds.com use.typekit.net js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.gstatic.com *.instagram.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.googleadservices.com *.google-analytics.com *assets.adobedtm.com *googleads.g.doubleclick.net *analytics.google.com *.googletagmanager.com *.cardinalcommerce.com *sandbox.paypal.com *.paypalobjects.com *t.paypal.com *s.ytimg.com https://www.gstatic.com/recaptcha https://www.google.com/recaptcha *.google.com/ *.avada.io *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com 'self' 'unsafe-eval' 'unsafe-hashes' 'nonce-bWNsY3p4Nmh6Ym8xZ2x3MWw4Y3JzbjM5NmNmbnRmcWQ=' 'sha256-W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=' 'sha256-3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=' 'sha256-2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=' 'sha256-p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=' 'sha256-0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=' 'sha256-nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=' local.adguard.org 'nonce-43e183d31a244cc9afdd777d8ef'". Either the 'unsafe-inline' keyword, a hash ('sha256-dn3M6MPF4GXog4BRnrw+ns2v/ER5GrnnRTSYtw/47qM='), or a nonce ('nonce-...') is required to enable inline execution.

checkout/:293 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com www.googleapis.com *.vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.commerce-payment-services.com *.typekit.net google.com *.google.com amcglobal.sc.omtrdc.net *.magento-ds.com use.typekit.net js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.gstatic.com *.instagram.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.googleadservices.com *.google-analytics.com *assets.adobedtm.com *googleads.g.doubleclick.net *analytics.google.com *.googletagmanager.com *.cardinalcommerce.com *sandbox.paypal.com *.paypalobjects.com *t.paypal.com *s.ytimg.com https://www.gstatic.com/recaptcha https://www.google.com/recaptcha *.google.com/ *.avada.io *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com 'self' 'unsafe-eval' 'unsafe-hashes' 'nonce-bWNsY3p4Nmh6Ym8xZ2x3MWw4Y3JzbjM5NmNmbnRmcWQ=' 'sha256-W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=' 'sha256-3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=' 'sha256-2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=' 'sha256-p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=' 'sha256-0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=' 'sha256-nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=' local.adguard.org 'nonce-43e183d31a244cc9afdd777d8ef'". Either the 'unsafe-inline' keyword, a hash ('sha256-TcUB1mzXiQO4GxpTRZ0EMpOXKMU3u+n/q1WrgVIcs1I='), or a nonce ('nonce-...') is required to enable inline execution.

Can someone kindly advise how to turn that into csp code?

3
  • "Did you manage to solve this issue?" Commented May 14 at 15:46
  • 1
    these are inline script issues, they will not be resolved using csp_whitelist.xml. You need to approach your developer or third party extension provider to resolve those issues. This blog article can help understand inline script issue scommerce-mage.com/blog/magento2-csp-whitelisting.html
    – MageWizard
    Commented May 27 at 11:29
  • I am facing the same issue, are you able to resolve this issue ? please update on this Commented Jun 4 at 18:22

4 Answers 4

1

Try the below code inside your custom module's csp_whitelist.xml

Please replace all hash values with your values.

<?xml version="1.0" encoding="UTF-8"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
        <policies>
            <policy id="object-src">
                <values>
                    <value id="hash" type="hash" algorithm="sha256">B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF8=</value>
                    <value id="hash2" type="hash" algorithm="sha256">B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF9=</value>
                </values>
            </policy>
            <policy id="script-src">
                <values>
                    <value id="adobedtmassets" type="host">assets.adobedtm.com</value>
                    <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                </values>
            </policy>
            <policy id="img-src">
                <values>
                    <value id="adobedtm-assets" type="host">assets.adobedtm.com</value>
                    <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                </values>
            </policy>
        </policies>
</csp_whitelist>
6
  • I am facing the same issue with hash on checkout page, are you able to resolve this issue ? please update on this Commented Jun 4 at 18:24
  • I have used it in one of our projects, you can try and check it once. Commented Jun 14 at 7:17
  • @ian have you tried this solution? Commented Jun 14 at 7:19
  • Hello. I have updated my first post with my current csp whitelist contents. I am still getting error messages in my Chrome console, so is there an error on my whitelist? Thanks!
    – Ian
    Commented Jun 17 at 11:37
  • Hi @JigarKarangiya , thank you for your solution involving adding the hash in 'object-src,' which is working fine and has successfully removed the error message from the console. However, the other solution regarding adding 'adobedtm-assets' has had no impact Commented Jun 20 at 9:08
1

In Adobe Commerce and Magento Open Source version 2.4.7 and later, CSP (Content Security Policy) is configured to operate in a restrictive mode by default for payment pages within both the storefront and admin areas. For these payment pages, the CSP header excludes the unsafe-inline keyword in the script-src directive, permitting only whitelisted inline scripts. For all other pages, CSP is set to "report-only" mode. You can adjust the CSP settings in a custom module by modifying the module's etc/config.xml file.

To temporarily get your checkout pages working while you whitelist the necessary external scripts, you can change the CSP mode for checkout pages to "report-only" and disable inline script blocking. Here’s how to do it:

Step 1: Create a Custom Module

Create the module directory structure:

app/code/[Vendor]/[ModuleName]/

Create the registration.php file:

<?php
\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    '[Vendor]_[ModuleName]',
    __DIR__
);

Create the etc/module.xml file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="[Vendor]_[ModuleName]" setup_version="1.0.0">
    </module>
</config>

Step 2: Configure CSP in config.xml

Create the etc/config.xml file to set the CSP mode for checkout pages:

<?xml version="1.0"?>

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront_checkout_index_index>
                    <report_only>1</report_only>
                </storefront_checkout_index_index>
            </mode>
            <policies>
                <storefront_checkout_index_index>
                    <scripts>
                        <inline>1</inline>
                    </scripts>
                </storefront_checkout_index_index>
            </policies>
        </csp>
    </default>
</config>

Run setup upgrade:

php bin/magento setup:upgrade

Deploy static content

php bin/magento setup:static-content:deploy -f

Clear the cache:

php bin/magento cache:clean

https://developer.adobe.com/commerce/php/development/security/content-security-policies/

1
  • This will solve the CSP issue on the checkout page.
    – Sumit
    Commented Jun 18 at 8:44
0

It can be long answer, but I will keep it simple so that you understand what needs to be done.

In your policy id script-src:

When you see this error:

checkout/:11 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com

This simply means that you need to add a line for assets.adobedtm.com.

<policy id="script-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            ...........
            <value id="graph-facebook" type="host">graph.facebook.com</value>
            <value id="adobe" type="host">assets.adobedtm.com</value>
        </values>
    </policy>

Try this and see if this starts to work.

If you want to make checkout work when you are working out these errors in your staging site:

In your custom module's config.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
  <default>
    <csp>
      <mode>
        <storefront>
          <report_only>1</report_only>
        </storefront>
        <admin>
          <report_only>1</report_only>
        </admin>
      </mode>
    </csp>
  </default>
</config>

Once you are able to whitelist all the external domains, then you can make these <report_only>1</report_only> to <report_only>0</report_only>.

7
  • OK. So do I also have to add lines for the rest of the sites in the error, *.adobe.com, www.googleadservices.com and so on?
    – Ian
    Commented Apr 26 at 5:43
  • Yes, that is correct. Commented Apr 26 at 5:44
  • Thanks. On examples with www. such as www.googleadservices.com, do I literally put that? Also lines such ashttps://www.google.com/recaptcha/ ? Is there a way they to be formatted? Thanks for your help!
    – Ian
    Commented Apr 26 at 9:03
  • 1
    If possible can you also explain what to do with the following: 'self' 'unsafe-eval' 'unsafe-hashes' 'nonce-bWNsY3p4Nmh6Ym8xZ2x3MWw4Y3JzbjM5NmNmbnRmcWQ=' 'sha256-W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=' 'sha256-3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=' 'sha256-2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=' 'sha256-p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=' 'sha256-0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=' 'sha256-nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=' local.adguard.org 'nonce-43e183d31a244cc9afdd777d8ef'".
    – Ian
    Commented Apr 26 at 9:48
  • this does not work. I'm also having this issue.
    – ItsJhonny
    Commented May 16 at 10:01
0

If you have a custom module, you can set the settings of CSP in your config.xml file.

For example, if you want to set everything to "report_only" even on the checkout page, use the following config.xml in your plugin.

<?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront_checkout_index_index>
                    <report_only>1</report_only>
                </storefront_checkout_index_index>
                <storefront>
                    <report_only>1</report_only>
                </storefront>
                <admin>
                    <report_only>1</report_only>
                </admin>
            </mode>
            </csp>
    </default> </config>
4
  • Thanks but I have already done that. Where I'm stuck now is dealing with browser console errors like: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com 'nonce-MDh4bWV0ZWUwM3Q5MGVwZHRvMGllMmNhem1rcHhzdGM=' 'sha256-W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=' 'nonce-fb4b6dd273584690b62038c0e02'". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.
    – Ian
    Commented Jun 13 at 17:43
  • Ok, that can also be resolved. In Chrome you can see the exact hash that you have to add. In your case 'W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=', so the string without the sha-256 piece. Add this to your csp_whitelist.xml as follows: <policy id="script-src"> <values> <value id="give-this-hash-a-name" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value> ... </values> </policy> Repeat this for all messages. Commented Jun 15 at 6:46
  • Thanks. However I have also done that and still get the error in my Chrome console?
    – Ian
    Commented Jun 17 at 11:26
  • Ok, that's strange. Did you use the correct hash value for each of the entries? Sometimes there are multiple messages. Commented Jun 18 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.