Questions tagged [csp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Magento 2.4.1 Content Security Policy (CSP) whitelist connect-src not wirking

I created a whitelist for content-src CSP like this: <policy id="connect-src"> <values> <value id="cloudflare" type="host">*....
0
votes
1answer
45 views

CSP Whitelist like ignored. How to set it?

I'm trying to set the CSP whitelist for Magento. I tried in many ways but I'm not able to make it works. The module is enabled but csp_whitelist.xml seems like ignored. After changed the file I run, ...
0
votes
3answers
55 views

Magento 2.4 Production mode issue

After upgrade Magento 2.3 to 2.4 and it gives me below error. main.CRITICAL: ParseError: syntax error, unexpected end of file in /var/www/html/magento24/var/view_preprocessed/pub/static/vendor/magento/...
0
votes
1answer
83 views

Magento 2 - How to allow livereload in CSP whitelist?

I can't use livereload anymore, because I get Refused to load the script 'http://www.company.de:35729/livereload.js' because it violates the following Content Security Policy directive ... Note that '...
0
votes
0answers
73 views

Magento 2.4 CSP

I've got a whitelist csp_whitelist.xml with the following - <?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:...
0
votes
1answer
25 views

Magento 2.3.5 Content Security Policy CSP for Worker

I was really annoyed by the lack of documentation around the following console errors showing up. [Report Only] Refused to create a worker from 'blob:https://domain.com/535c516f-8a3a-4d17-b0c0-...
2
votes
0answers
44 views

Magento 2: Content Security Policy disabled, still get errors

So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml All fine and dandy but then I stumbled upon this ...
0
votes
0answers
121 views

Magento 2.3.5: The content security policy related notices in the browser console after Magento upgrade to 2.3.5

Upgrading to 2.3.5 has lead to hundreds of notices in the front end as seen in the screenshot below. The devdoc explaining the CSP isn't detailed enough to find a solution to this. Can anyone show ...
2
votes
1answer
36 views

CSP Reports being thrown, even after allowing links in whitelist

I created a new module to allow urls, and have them not make noise about csp. I have a csp_whitelist file under /etc, and I've added all of my links to it (and cleared the cache), but the warnings ...
11
votes
9answers
8k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....