Questions tagged [csp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

Customer Login not working into iframe for magento 2.4

I am working on magento website http://20.204.34.13/ i want to load this site into iframe. Site is loading but customer login is not working. Does anyone can suggest solution for this. Below is ...
Santosh Yadav's user avatar
0 votes
0 answers
126 views

Having issue with Content Security Policy in my frontend pages

I am facing the issue in the console With Content Security Policy ,I cant disable the Module Magento_Csp ,Please suggest the solution based on my efollowing console error [Report Only] Refused to load ...
Muhammad Abdullah's user avatar
0 votes
0 answers
20 views

Too many CSP Whitelist headers

I am getting errors on CSP_Whitelist headers in an apache2.4 environment. Apparently, there are too many of them, And I can't say which ones are more important than others. Is there a way to determine ...
Jo-Anne's user avatar
  • 43
1 vote
2 answers
56 views

Magento 2 - after Plugin for \Magento\Csp\Model\Policy\FetchPolicy not working

Why is my plugin not getting called? app/code/Company/Configurator/etc/module.xml: <?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:...
Black's user avatar
  • 3,280
1 vote
3 answers
440 views

Magento 2 - how to fix CSP module [Report Only] messages?

I'm checking my website's error console and I see that there are errors in the console: [Report Only] Refused to frame 'https://ct.pinterest.com/' because it violates the following Content Security ...
Jackom's user avatar
  • 473
0 votes
2 answers
619 views

Magento form-action CSP not working

Refused to send form data to 'https://example.com/customer/account/logout/' because it violates the following Content Security Policy directive: "form-action 'self' secure.authorize.net test....
Rita555-Simon's user avatar
1 vote
1 answer
124 views

Getting CSP related error on custom plugin page in admin in Magento 2.4.3

We have one custom plugin that is used for product import. when we try to visit the page of this extension in the admin we are getting an error. check below stack trace. 1 exception(s): Exception #0 (...
Chintan Kaneriya's user avatar
1 vote
1 answer
1k views

Refused to load the font <URL> because it violates the following CSP directive:font-src *.fontawesome.com data: 'self' 'unsafe-inline

[Report Only] Refused to load the font '' because it violates the following Content Security Policy directive: "font-src *.fontawesome.com data: 'self' 'unsafe-inline'". [Report Only] ...
Marcello Berti's user avatar
2 votes
1 answer
2k views

The CSP directive 'frame-ancestors' does not support the source expression ''unsafe-inline''

I can't succeed to make this error messages removed from my M 2.4 I did my custom csp module, everything works fine except this one The Content-Security-Policy directive 'frame-ancestors' does not ...
Claims's user avatar
  • 1,146
2 votes
0 answers
442 views

Magento 2.4.2: [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net

One of a few content security policy directive issues seen in the console when visiting a product page is what reads on below. [Report Only] Refused to load the script 'https://googleads.g.doubleclick....
CodeForGood's user avatar
0 votes
3 answers
637 views

CSP Refused to load internal resources on cart and checkout - Magento 2.4

We get a lot of [Report Only] Refused to load because it does not appear in the script-src directive of the Content Security Policy. errors in the browser console in the cart and in the checkout. We ...
JGeer's user avatar
  • 1,416
0 votes
1 answer
1k views

Magento 2 - CSP whitelist not work for subdomain

I have whitelisted all the resources that come from facebook inside the csp_whitelist.xml file and for my main domain: www.magento2.com works without problems. But for my subdomains the csp_whitelist ...
Jackom's user avatar
  • 473
0 votes
0 answers
43 views

Magento 2.4.2 - Why amazon scripts are flagged as CSP violation?

I believe the Amazon integration is out of the box when it comes to Magento 2. Why is it being flagged in the chrome console as a CSP violation? The module in vendor has its own csp_whitelist.xml ...
Greg's user avatar
  • 2,929
0 votes
1 answer
702 views

Magento CSP issue: Refused to load the script

I whitelisted all domains in my module's csp_whitelist.xml file and it is working as expected except google-analytics, I tried adding it to the file but after adding it is giving the same error. I ...
Surjan Raghuwanshi's user avatar
0 votes
2 answers
1k views

Assist with Magento 2.3.5 CSP (Magento_Csp) csp_whitelist.xml configuration - `style-src 'self'` entries reported

I have followed documentation for setting up CSP whitelist using csp_whitelist.xml in a new module, but something is missing/not working as it should. Issue I have 100s of style-src 'self' 'report-...
CvRChameleon's user avatar
0 votes
1 answer
335 views

Magento CSP: style-src missing from response header

We have added <?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:...
fritzmg's user avatar
  • 747
0 votes
1 answer
264 views

Getting the error message: Either remote URL or hashable content is required to whitelist

Getting this error message when loading the homepage. 1 exception(s): Exception #0 (InvalidArgumentException): Either remote URL or hashable content is required to whitelist
Adam's user avatar
  • 587
1 vote
0 answers
27 views

Magento 2 Content Security Policy: The page’s settings observed the loading of a resource at https://xuz/font-awesome.min.css (“style-src”) [duplicate]

We transfer hosting to another hosting company everything is working fine but we are getting console errors in firefox like this - "The page’s settings observed the loading of a resource at https:...
sumeet bajaj's user avatar
  • 1,286
0 votes
2 answers
355 views

Magento 2 Admin user can't access Admin menus

I have a Magento 2.4.1 admin instance, I have created a Admin user through command line, But am able to login but cant access anything. how to to add this permission to admin user. I cant access ...
Praveen Negimani's user avatar
0 votes
1 answer
260 views

New Relic Magento\Csp\Model\CompositePolicyCollector::merge - Magento 2.4

In our New Relic we see the following component consuming 25% of the time of the catalog search page; Magento\Csp\Model\CompositePolicyCollector::merge What is casing this load? What section of ...
JGeer's user avatar
  • 1,416
2 votes
1 answer
5k views

Magento 2.4.1 Custom Content Security Policy (CSP) whitelist for connect-src not Working

I created a whitelist for content-src CSP like this: <policy id="connect-src"> <values> <value id="cloudflare" type="host">*....
Tiny Dancer's user avatar
2 votes
1 answer
830 views

CSP Whitelist like ignored. How to set it?

I'm trying to set the CSP whitelist for Magento. I tried in many ways but I'm not able to make it works. The module is enabled but csp_whitelist.xml seems like ignored. After changed the file I run, ...
KaMZaTa's user avatar
  • 205
0 votes
3 answers
322 views

Magento 2.4 Production mode issue

After upgrade Magento 2.3 to 2.4 and it gives me below error. main.CRITICAL: ParseError: syntax error, unexpected end of file in /var/www/html/magento24/var/view_preprocessed/pub/static/vendor/magento/...
MK Patel's user avatar
  • 422
1 vote
3 answers
2k views

Magento 2 - How to allow livereload in CSP whitelist?

I can't use livereload anymore, because I get Refused to load the script 'http://www.company.de:35729/livereload.js' because it violates the following Content Security Policy directive ... Note that '...
Black's user avatar
  • 3,280
1 vote
1 answer
1k views

Magento 2.4 CSP

I've got a whitelist csp_whitelist.xml with the following - <?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:...
Chris Oliver's user avatar
0 votes
1 answer
709 views

Magento 2.3.5 Content Security Policy CSP for Worker

I was really annoyed by the lack of documentation around the following console errors showing up. [Report Only] Refused to create a worker from 'blob:https://domain.com/535c516f-8a3a-4d17-b0c0-...
Kay Int Veen's user avatar
  • 1,503
2 votes
1 answer
1k views

Magento 2: Content Security Policy disabled, still get errors

So I started a new magento project with 2.3.5-p1 and stumbled right into the new CSP feature. I figured it out and created my custom csp_whitelist.xml All fine and dandy but then I stumbled upon this ...
omsta's user avatar
  • 698
0 votes
0 answers
330 views

Magento 2.3.5: The content security policy related notices in the browser console after Magento upgrade to 2.3.5

Upgrading to 2.3.5 has lead to hundreds of notices in the front end as seen in the screenshot below. The devdoc explaining the CSP isn't detailed enough to find a solution to this. Can anyone show ...
CodeForGood's user avatar
2 votes
1 answer
211 views

CSP Reports being thrown, even after allowing links in whitelist

I created a new module to allow urls, and have them not make noise about csp. I have a csp_whitelist file under /etc, and I've added all of my links to it (and cleared the cache), but the warnings ...
web master's user avatar
19 votes
10 answers
30k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....
Konrad Siamro's user avatar