Questions tagged [csp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
23 views

Magento 2 Content Security Policy: The page’s settings observed the loading of a resource at https://xuz/font-awesome.min.css (“style-src”) [duplicate]

We transfer hosting to another hosting company everything is working fine but we are getting console errors in firefox like this - "The page’s settings observed the loading of a resource at https:...
0
votes
0answers
43 views

Magento 2.4.1: How to resolve [Report Only] Refused to load the font '<URL>' because it violates the following Content Security Policy directive:

With a custom module, I am trying to resolve the content security policy warnings. I'm not sure under which policy should I place the URLS reported by Refused to connect to. Pleae guide me as to how ...
0
votes
2answers
40 views

Magento 2 Admin user can't access Admin menus

I have a Magento 2.4.1 admin instance, I have created a Admin user through command line, But am able to login but cant access anything. how to to add this permission to admin user. I cant access ...
0
votes
1answer
67 views

New Relic Magento\Csp\Model\CompositePolicyCollector::merge - Magento 2.4

In our New Relic we see the following component consuming 25% of the time of the catalog search page; Magento\Csp\Model\CompositePolicyCollector::merge What is casing this load? What section of ...
0
votes
1answer
272 views

Magento 2.4.1 Custom Content Security Policy (CSP) whitelist for connect-src not Working

I created a whitelist for content-src CSP like this: <policy id="connect-src"> <values> <value id="cloudflare" type="host">*....
0
votes
1answer
105 views

CSP Whitelist like ignored. How to set it?

I'm trying to set the CSP whitelist for Magento. I tried in many ways but I'm not able to make it works. The module is enabled but csp_whitelist.xml seems like ignored. After changed the file I run, ...
0
votes
3answers
89 views

Magento 2.4 Production mode issue

After upgrade Magento 2.3 to 2.4 and it gives me below error. main.CRITICAL: ParseError: syntax error, unexpected end of file in /var/www/html/magento24/var/view_preprocessed/pub/static/vendor/magento/...
0
votes
2answers
269 views

Magento 2 - How to allow livereload in CSP whitelist?

I can't use livereload anymore, because I get Refused to load the script 'http://www.company.de:35729/livereload.js' because it violates the following Content Security Policy directive ... Note that '...
0
votes
0answers
313 views

Magento 2.4 CSP

I've got a whitelist csp_whitelist.xml with the following - <?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:...
0
votes
1answer
83 views

Magento 2.3.5 Content Security Policy CSP for Worker

I was really annoyed by the lack of documentation around the following console errors showing up. [Report Only] Refused to create a worker from 'blob:https://domain.com/535c516f-8a3a-4d17-b0c0-...
2
votes
0answers
218 views

Magento 2: Content Security Policy disabled, still get errors

So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml All fine and dandy but then I stumbled upon this ...
0
votes
0answers
214 views

Magento 2.3.5: The content security policy related notices in the browser console after Magento upgrade to 2.3.5

Upgrading to 2.3.5 has lead to hundreds of notices in the front end as seen in the screenshot below. The devdoc explaining the CSP isn't detailed enough to find a solution to this. Can anyone show ...
2
votes
1answer
75 views

CSP Reports being thrown, even after allowing links in whitelist

I created a new module to allow urls, and have them not make noise about csp. I have a csp_whitelist file under /etc, and I've added all of my links to it (and cleared the cache), but the warnings ...
13
votes
9answers
14k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....