Skip to main content

Questions tagged [content-security-policy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
719 views

Magento form-action CSP not working

Refused to send form data to 'https://example.com/customer/account/logout/' because it violates the following Content Security Policy directive: "form-action 'self' secure.authorize.net test....
Rita555-Simon's user avatar
1 vote
1 answer
1k views

Refused to load the font <URL> because it violates the following CSP directive:font-src *.fontawesome.com data: 'self' 'unsafe-inline

[Report Only] Refused to load the font '' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com data: 'self' 'unsafe-inline'". [Report Only] ...
Marcello Berti's user avatar
1 vote
1 answer
4k views

csp_whitelist.xml for themes

Content security policies for custom modules can be added by setting up a csp_whitelist.xml file, i.e. app/code/Vendorname/Modulename/etc/cps_whitelist.xml, this is more or less excessively described ...
Christoph Farnleitner's user avatar
0 votes
1 answer
632 views

Magento2.4 refused to load all external resources

I have a Magento2.4 website and when I view the console I see the below errors. I read about creating a CSP module to whitelist the domain names however it does not seem to work? I do see ...
Jayreis's user avatar
  • 725
2 votes
3 answers
6k views

Magento 2.4.1 Custom Content Security Policy (CSP) whitelist for connect-src not Working

I created a whitelist for content-src CSP like this: <policy id="connect-src"> <values> <value id="cloudflare" type="host">*....
Tiny Dancer's user avatar
0 votes
0 answers
66 views

Category/search images not showing in Firefox

I get Content Security Policy errors in Firefox. I have a CSP module that handles this just fine in Chrome, but this remains an issue in Firefox. Are there more steps that have to be taken to make ...
web master's user avatar
0 votes
1 answer
1k views

X-Frame-Options in Magento 2.3.5-p1

I've set X-Frame-Options 'x-frame-options' => '*', in env as mentioned in the doc Magento Docs But still I'm getting this error Refused to display 'https://mythridpartyurlhere.com/' in a frame ...
Afreen Sheikh's user avatar
0 votes
1 answer
840 views

Magento 2.3.5 Content Security Policy CSP for Worker

I was really annoyed by the lack of documentation around the following console errors showing up. [Report Only] Refused to create a worker from 'blob:https://domain.com/535c516f-8a3a-4d17-b0c0-...
Kay Int Veen's user avatar
  • 1,503
2 votes
1 answer
2k views

Magento 2: Content Security Policy disabled, still get errors

So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml All fine and dandy but then I stumbled upon this ...
omsta's user avatar
  • 698