I just can't seem to wrap my head around this with my checkout and payment processing not working. I'm running Magento 2.4.7 and my store runs well. I can view, choose and add products to my cart. If I try to go to my checkout, the page processes endlessly and it never loads the customer information form and so on. If I try to click on the Paypal quick link while viewing a product, the popup flashes an goes away. Now if I inspect the page, it shows me several CSP errors, unknown property warnings, and "A resource is blocked by OpaqueResponseBlocking, please check browser console for details." I know the warnings are one thing but what's with the CSP? I am using a stock setup for 2.4.7 and added the basic information with nothing custom. I have no clue why I can't even get to my checkout let alone get to processing a payment. I've read some things about a whitelist but have absolutely no clue where to begin there. Any help would be great as always.
-
Try to debug this way: 1. Disable the CSP module 2. Check system, exception log 3. Check the browser console log After that share here. Otherwise, no one can help you by guessing something.– Sohel RanaCommented Apr 28 at 10:45
-
The Module_Csp is required by a significant number of other modules and I'm getting errors trying to disable it. In the exception.log currently is a reference to twofactorauthenticqtion which I had disabled during development. I re-enabled it but for some reason it's not setting up and the problems still are occurring. Same errors in my console.– jfgraphixCommented Apr 29 at 14:27
-
Better if you can share real error which you facing?– Dhiren VasoyaCommented Apr 30 at 4:36
-
I encountered similar challenges with Magento 2.4.7, where the checkout was throwing so many errors on the frontend. I discovered a blog article scommerce-mage.com/blog/magento2-csp-whitelisting.html that provided comprehensive details and proved instrumental in resolving the checkout issues I faced– stevensagaarCommented May 23 at 17:26
3 Answers
In Adobe Commerce and Magento Open Source version 2.4.7 and later, CSP is configured in restrict-mode by default for payment pages in the storefront and admin areas, and in report-only mode for all other pages. The corresponding CSP header does not contain the unsafe-inline keyword inside the script-src directive for payment pages. Also, only whitelisted inline scripts are allowed.
You can set the CSP mode in a custom module by editing the module's etc/config.xml file.
You should create a whitelist for external scripts used by checkout but to get the pages working again you can change the checkout csp mode to report only and disable inline script blocking with:
<csp>
<mode>
<storefront_checkout_index_index>
<report_only>1</report_only>
</storefront_checkout_index_index>
</mode>
<policies>
<storefront_checkout_index_index>
<scripts>
<inline>0</inline>
<event_handlers>0</event_handlers>
</scripts>
</storefront_checkout_index_index>
</policies>
</csp>
See https://developer.adobe.com/commerce/php/development/security/content-security-policies/
-
Thanks for all the help, the template that I originally used included invalid XML formatting and caused the issues to occur. After resolving those errors in the file, I have finally been able to process the checkout. This problem has been solve, thank you to the community! Commented May 5 at 15:15
-
do we need to create config.xml and put above code into that ? Commented May 13 at 5:52
After upgrading to Magento 2.4.7 I've set CSP back to report only mode by SQL:
insert into core_config_data (scope, scope_id, path, value) values
('default', 0, 'csp/mode/storefront_checkout_index_index/report_only', 1)
on duplicate key update value = VALUES(value);
and do not forget to clean config cache:
php bin/magento cache:clean config
If you want to run the checkout page without js errors Just add the following configuration in app/etc/env.php or app/etc/config.php file
'csp' => [
'mode' => [
'storefront_checkout_index_index' => [
'report_only' => '1'
],
'admin_sales_order_create_index' => [
'report_only' => '1'
]
],
'policies' => [
'storefront_checkout_index_index' => [
'scripts' => [
'inline' => '1'
]
],
'admin_sales_order_create_index' => [
'scripts' => [
'inline' => '1'
]
]
]
]
Run the following command after adding this:
bin/magento app:config:import
bin/magento cache:clean
