0

This is a follow up to this question: Magento 2.4.7 - Advice setting up csp I have set-up/configured a custom csp module. This is the current csp_whitelist.xml:

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
    <policies>
        <policy id="default-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="base-uri">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="font-src">
            <values>
                <value id="data" type="host">'self' data: https://maxcdn.bootstrapcdn.com</value>
                <value id="bootstrapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="googleapis" type="host">*.googleapis.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
            </values>
        </policy>
        <policy id="style-src">
            <values>
                <value id="hash" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value>
                <value id="hash2" type="hash" algorithm="sha256">3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=</value>
                <value id="hash3" type="hash" algorithm="sha256">2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=</value>
                <value id="hash4" type="hash" algorithm="sha256">p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=</value>
                <value id="hash5" type="hash" algorithm="sha256">0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=</value>
                <value id="hash6" type="hash" algorithm="sha256">nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=</value>
                <value id="data" type="host">'report-sample'</value>
                <value id="data2" type="host">'self'</value>
                <value id="data3" type="host">'unsafe-inline'</value>
                <value id="data4" type="host">https://maxcdn.bootstrapcdn.com</value>
                <value id="bootstrapcdn" type="host">*.bootstrapcdn.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="fontawesome" type="host">*.fontawesome.com</value>
                <value id="google-apis" type="host">*.googleapis.com</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
            </values>
        </policy>
        <policy id="img-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="adobedtm-assets" type="host">assets.adobedtm.com</value>
                <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="googleadservices" type="host">*.googleadservices.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="vimeocdn" type="host">*.vimeocdn.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="google-maps" type="host">'self' https://maps.googleapis.com</value>
            </values>
        </policy>
        <policy id="frame-src">
            <values>
                <value id="data" type="host">'self'</value>
                <value id="stripe" type="host">https://js.stripe.com</value>
                <value id="google" type="host">*.google.com</value>
            </values>
        </policy>
        <policy id="script-src">
            <values>
                <value id="hash" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value>
                <value id="hash2" type="hash" algorithm="sha256">3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=</value>
                <value id="hash3" type="hash" algorithm="sha256">2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=</value>
                <value id="hash4" type="hash" algorithm="sha256">p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=</value>
                <value id="hash5" type="hash" algorithm="sha256">0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=</value>
                <value id="hash6" type="hash" algorithm="sha256">nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=</value>
                <value id="report-sample" type="host">'report-sample'</value>
                <value id="self" type="host">'self'</value>
                <value id="unsafe-eval" type="host">'unsafe-eval'</value>
                <value id="unsafe-hashes" type="host">'unsafe-hashes'</value>
                <value id="unsafe-inline" type="host">'unsafe-inline'</value>
                <value id="adobedtm-assets" type="host">assets.adobedtm.com</value>
                <value id="adobedtm-all" type="host">*.adobedtm.com</value>
                <value id="adobe" type="host">*.adobe.com</value>
                <value id="avada" type="host">*.avada.io</value>
                <value id="amcglobal" type="host">amcglobal.sc.omtrdc.net</value>
                <value id="braintree-api" type="host">api.braintreegateway.com</value>
                <value id="braintree-sandbox" type="host">api.sandbox.braintreegateway.com</value>
                <value id="braintree-analytics" type="host">client-analytics.braintreegateway.com</value>
                <value id="braintree-analytics-sand" type="host">client-analytics.sandbox.braintreegateway.com</value>
                <value id="braintree-js" type="host">js.braintreegateway.com</value>
                <value id="braintree-assets" type="host">assets.braintreegateway.com</value>
                <value id="cardinalcommerce" type="host">geostag.cardinalcommerce.com</value>
                <value id="cardinalcommerce2" type="host">1eafstag.cardinalcommerce.com</value>
                <value id="cardinalcommerce3" type="host">geoapi.cardinalcommerce.com</value>
                <value id="cardinalcommerce4" type="host">1eafapi.cardinalcommerce.com</value>
                <value id="cardinalcommerce5" type="host">songbird.cardinalcommerce.com</value>
                <value id="cardinalcommerce6" type="host">*.cardinalcommerce.com</value>
                <value id="cardinalcommerce7" type="host">songbirdstag.cardinalcommerce.com</value>
                <value id="commerce-payment8" type="host">*.commerce-payment-services.com</value>
                <value id="cloudflare" type="host">*.cloudflare.com</value>
                <value id="google-pay" type="host">pay.google.com</value>
                <value id="google-analytics" type="host">*.google-analytics.com</value>
                <value id="google-analytics2" type="host">www.google-analytics.com</value>
                <value id="google-analytics3" type="host">analytics.google.com</value>
                <value id="google-analytics4" type="host">analytics.google.com</value>
                <value id="googletagmanager" type="host">googletagmanager.com</value>
                <value id="googletagmanager2" type="host">www.googletagmanager.com</value>
                <value id="googletagmanager3" type="host">*.googletagmanager.com</value>
                <value id="google-apis" type="host">apis.google.com</value>
                <value id="google-apis2" type="host">*.googleapis.com</value>
                <value id="google-apis3" type="host">www.googleapis.com</value>
                <value id="google-ads" type="host">www.googleadservices.com</value>
                <value id="google-ads2" type="host">googleads.g.doubleclick.net</value>
                <value id="google-ads3" type="host">*.googleadservices.com</value>
                <value id="google-ads4" type="host">googleads.g.doubleclick.net</value>
                <value id="gstatic" type="host">*.gstatic.com</value>
                <value id="google-recaptcha" type="host">https://www.gstatic.com/recaptcha/</value>
                <value id="google-recaptcha2" type="host">https://www.google.com/recaptcha/</value>
                <value id="google-recaptcha3" type="host">www.google.com/recaptcha/</value>
                <value id="google-recaptcha4" type="host">www.gstatic.com/recaptcha/</value>
                <value id="google-recaptcha5" type="host">https://www.gstatic.com/recaptcha</value>
                <value id="google-recaptcha6" type="host">https://www.google.com/recaptcha</value>
                <value id="google" type="host">google.com</value>
                <value id="google2" type="host">*.google.com</value>
                <value id="google3" type="host">*.google.com/</value>
                <value id="google-maps" type="host">https://maps.googleapis.com/maps/api/js</value>
                <value id="includestest" type="host">includestest.ccdc02.com</value>
                <value id="instagram" type="host">*.instagram.com</value>
                <value id="klarna" type="host">klarna.com</value>
                <value id="klarna2" type="host">*.klarna.com</value>
                <value id="klarna3" type="host">*.klarnacdn.net</value>
                <value id="klarna4" type="host">*.klarnaevt.com</value>
                <value id="magento-ds" type="host">*.magento-ds.com</value>
                <value id="newrelic" type="host">*.newrelic.com</value>
                <value id="nr-data" type="host">*.nr-data.net</value>
                <value id="paypal" type="host">www.paypal.com</value>
                <value id="paypal-objects" type="host">www.paypalobjects.com</value>
                <value id="paypal-objects2" type="host">*.paypalobjects.com</value>
                <value id="paypal-t" type="host">t.paypal.com</value>
                <value id="paypal-c" type="host">c.paypal.com</value>
                <value id="paypal-all" type="host">*.paypal.com</value>
                <value id="paypal-sandbox" type="host">www.sandbox.paypal.com</value>
                <value id="paypal-sandbox2" type="host">sandbox.paypal.com</value>
                <value id="paypal-sandbox3" type="host">*.sandbox.paypal.com</value>
                <value id="paypal-t2" type="host">t.paypal.com</value>
                <value id="stripe-js" type="host">https://js.stripe.com/v3/</value>
                <value id="stripe-all" type="host">*.stripe.com</value>
                <value id="stripe-link" type="host">*.link.com</value>
                <value id="typekit" type="host">*.typekit.net</value>
                <value id="typekit2" type="host">use.typekit.net</value>
                <value id="vimeo" type="host">*.vimeo.com</value>
                <value id="vimeo2" type="host">www.vimeo.com</value>
                <value id="vimeo3" type="host">*.vimeocdn.com</value>
                <value id="youtube" type="host">*.youtube.com</value>
                <value id="ytimg" type="host">s.ytimg.com</value>
            </values>
        </policy>
        <policy id="media-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="manifest-src">
            <values>
                <value id="data" type="host">'self'</value>
            </values>
        </policy>
        <policy id="object-src">
            <values>
                <value id="data" type="host">'none'</value>
                <value id="hash" type="hash" algorithm="sha256">W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=</value>
                <value id="hash2" type="hash" algorithm="sha256">3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=</value>
                <value id="hash3" type="hash" algorithm="sha256">2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=</value>
                <value id="hash4" type="hash" algorithm="sha256">p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=</value>
                <value id="hash5" type="hash" algorithm="sha256">0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=</value>
                <value id="hash6" type="hash" algorithm="sha256">nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=</value>
            </values>
        </policy>
        <policy id="worker-src">
            <values>
                <value id="data" type="host">'none'</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

I need assistance with stopping the following console errors (I have another 8 similar):

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com *.adobe.com googleads.g.doubleclick.net analytics.google.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com t.paypal.com s.ytimg.com *.vimeo.com *.vimeocdn.com *.youtube.com *.commerce-payment-services.com *.typekit.net google.com *.google.com amcglobal.sc.omtrdc.net *.magento-ds.com use.typekit.net js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.gstatic.com *.instagram.com 'report-sample' 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' *.adobedtm.com *.avada.io *.cardinalcommerce.com *.cloudflare.com *.google-analytics.com googletagmanager.com *.googletagmanager.com apis.google.com *.googleadservices.com *.google.com/ klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.paypalobjects.com sandbox.paypal.com *.sandbox.paypal.com *.stripe.com *.link.com 'self' 'unsafe-eval' 'unsafe-hashes' 'nonce-b243ZGoxZTNxcW83MHFsZzY3dGgxcnNmOXlweGtnY2Q=' 'sha256-W5akSSK6LD5BjIlNICMcXaUObQSRAaj6bs7JHADURBA=' 'sha256-3qVqeAdyxxTdPkkRzqapjGkAUYLahxSrB7Mdup+GPQ0=' 'sha256-2rvfFrggTCtyF5WOiTri1gDS8Boibj4Njn0e+VCBmDI=' 'sha256-p8MCfMHqrovsjRYU9z0bU17dd0z81k/fVbGrtBBiM9g=' 'sha256-0pk2s4oXwBELlC6IBVb3nNaM2PjfjwI2N6OGIX5lx8Y=' 'sha256-nkEZknO0IxNxY/CkTMBhjNhwPvglpYumjx31B4fjkY8=' local.adguard.org 'nonce-5f7358088e0046b0b925f4cfd5b'". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.

I have added the sha256 values to the whitelist but this has not stopped the console errors. What am I doing wrong please?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.