Questions tagged [csp]
The csp tag has no usage guidance.
27
questions
0
votes
2
answers
46
views
Magento 2 - how to fix CSP module [Report Only] messages?
I'm checking my website's error console and I see that there are errors in the console:
[Report Only] Refused to frame 'https://ct.pinterest.com/' because it violates the following Content Security ...
- 419
0
votes
2
answers
237
views
Magento form-action CSP not working
Refused to send form data to 'https://example.com/customer/account/logout/'
because it violates the following Content Security Policy directive: "form-action
'self' secure.authorize.net test....
0
votes
1
answer
67
views
Getting CSP related error on custom plugin page in admin in Magento 2.4.3
We have one custom plugin that is used for product import. when we try to visit the page of this extension in the admin we are getting an error. check below stack trace.
1 exception(s):
Exception #0 (...
- 627
1
vote
1
answer
757
views
Refused to load the font <URL> because it violates the following CSP directive:font-src *.fontawesome.com data: 'self' 'unsafe-inline
[Report Only] Refused to load the font '' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com data: 'self' 'unsafe-inline'".
[Report Only] ...
2
votes
1
answer
1k
views
The CSP directive 'frame-ancestors' does not support the source expression ''unsafe-inline''
I can't succeed to make this error messages removed from my M 2.4
I did my custom csp module, everything works fine except this one
The Content-Security-Policy directive 'frame-ancestors' does not ...
- 1,054
0
votes
0
answers
157
views
How to resolve content security policy I want to add ADA Compliance from in magento 2.4.3?
I want to whitelist my ADA Compliance script into magento_csp for that i have created CSP_whitelist.xml for resolve following error
Error : Refused to load the script 'https://acsbapp.com/apps/app/...
- 41
2
votes
0
answers
285
views
Magento 2.4.2: [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net
One of a few content security policy directive issues seen in the console when visiting a product page is what reads on below.
[Report Only] Refused to load the script 'https://googleads.g.doubleclick....
- 682
0
votes
3
answers
427
views
CSP Refused to load internal resources on cart and checkout - Magento 2.4
We get a lot of [Report Only] Refused to load because it does not appear in the script-src directive of the Content Security Policy. errors in the browser console in the cart and in the checkout.
We ...
- 1,446
0
votes
1
answer
652
views
Magento 2 - CSP whitelist not work for subdomain
I have whitelisted all the resources that come from facebook inside the csp_whitelist.xml file and for my main domain: www.magento2.com works without problems.
But for my subdomains the csp_whitelist ...
- 419
0
votes
0
answers
36
views
Magento 2.4.2 - Why amazon scripts are flagged as CSP violation?
I believe the Amazon integration is out of the box when it comes to Magento 2. Why is it being flagged in the chrome console as a CSP violation?
The module in vendor has its own csp_whitelist.xml ...
- 2,889
0
votes
1
answer
479
views
Magento CSP issue: Refused to load the script
I whitelisted all domains in my module's csp_whitelist.xml file and it is working as expected except google-analytics, I tried adding it to the file but after adding it is giving the same error.
I ...
0
votes
2
answers
727
views
Assist with Magento 2.3.5 CSP (Magento_Csp) csp_whitelist.xml configuration - `style-src 'self'` entries reported
I have followed documentation for setting up CSP whitelist using csp_whitelist.xml in a new module, but something is missing/not working as it should.
Issue
I have 100s of style-src 'self' 'report-...
- 651
0
votes
1
answer
230
views
Magento CSP: style-src missing from response header
We have added
<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:...
- 717
0
votes
1
answer
234
views
Getting the error message: Either remote URL or hashable content is required to whitelist
Getting this error message when loading the homepage.
1 exception(s):
Exception #0 (InvalidArgumentException): Either remote URL or hashable content is required to whitelist
- 527
1
vote
0
answers
26
views
Magento 2 Content Security Policy: The page’s settings observed the loading of a resource at https://xuz/font-awesome.min.css (“style-src”) [duplicate]
We transfer hosting to another hosting company everything is working fine but we are getting console errors in firefox like this - "The page’s settings observed the loading of a resource at https:...
- 1,195
0
votes
2
answers
293
views
Magento 2 Admin user can't access Admin menus
I have a Magento 2.4.1 admin instance, I have created a Admin user through command line,
But am able to login but cant access anything. how to to add this permission to admin user.
I cant access ...
- 448
0
votes
1
answer
226
views
New Relic Magento\Csp\Model\CompositePolicyCollector::merge - Magento 2.4
In our New Relic we see the following component consuming 25% of the time of the catalog search page;
Magento\Csp\Model\CompositePolicyCollector::merge
What is casing this load? What section of ...
- 1,446
1
vote
1
answer
4k
views
Magento 2.4.1 Custom Content Security Policy (CSP) whitelist for connect-src not Working
I created a whitelist for content-src CSP like this:
<policy id="connect-src">
<values>
<value id="cloudflare" type="host">*....
- 600
2
votes
1
answer
612
views
CSP Whitelist like ignored. How to set it?
I'm trying to set the CSP whitelist for Magento. I tried in many ways but I'm not able to make it works.
The module is enabled but csp_whitelist.xml seems like ignored. After changed the file I run, ...
- 175
0
votes
3
answers
261
views
Magento 2.4 Production mode issue
After upgrade Magento 2.3 to 2.4 and it gives me below error.
main.CRITICAL: ParseError: syntax error, unexpected end of file in /var/www/html/magento24/var/view_preprocessed/pub/static/vendor/magento/...
- 422
1
vote
3
answers
1k
views
Magento 2 - How to allow livereload in CSP whitelist?
I can't use livereload anymore, because I get
Refused to load the script 'http://www.company.de:35729/livereload.js' because it violates the
following Content Security Policy directive ... Note that
'...
- 2,993
1
vote
0
answers
946
views
Magento 2.4 CSP
I've got a whitelist csp_whitelist.xml with the following -
<?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:...
- 83
0
votes
1
answer
534
views
Magento 2.3.5 Content Security Policy CSP for Worker
I was really annoyed by the lack of documentation around the following console errors showing up.
[Report Only] Refused to create a worker from 'blob:https://domain.com/535c516f-8a3a-4d17-b0c0-...
- 1,493
2
votes
1
answer
882
views
Magento 2: Content Security Policy disabled, still get errors
So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml
All fine and dandy but then I stumbled upon this ...
- 672
0
votes
0
answers
312
views
Magento 2.3.5: The content security policy related notices in the browser console after Magento upgrade to 2.3.5
Upgrading to 2.3.5 has lead to hundreds of notices in the front end as seen in the screenshot below. The devdoc explaining the CSP isn't detailed enough to find a solution to this. Can anyone show ...
- 682
2
votes
1
answer
176
views
CSP Reports being thrown, even after allowing links in whitelist
I created a new module to allow urls, and have them not make noise about csp.
I have a csp_whitelist file under /etc, and I've added all of my links to it (and cleared the cache), but the warnings ...
- 313
19
votes
10
answers
29k
views
Magento 2.3.5-p1 CSP font-src self unsafe-inline
In regarding to CSP I create own csp_whitelist, but still I am getting:
The Content Security Policy 'font-src 'self' 'unsafe-inline';
form-action secure.authorize.net test.authorize.net
geostag....
- 1,449