search

klaviyo / magento2-klaviyo

37 stars 51 forks source link

Insufficient CSP whitelisting for connect-src and img-src #82

Closed zaximus84 closed 3 years ago

zaximus84 commented 3 years ago

When visiting the storefront, there are Content Security Policy violations for these files:

(XHR) https://fast.a.klaviyo.com/onsite/api/v2/modules?company_id={company id}

(Image) https://a.klaviyo.com/api/track?data={data}&company_id={company id}&i=1

It looks like more coverage needs to be added to csp_whitelist.xml. I was able to fix it with a patch that adds the following entries:

`

https://fast.a.klaviyo.com https://a.klaviyo.com

`

remstone7 commented 3 years ago

Thank you for pointing this out - we will take a look at this and patch

remstone7 commented 3 years ago

https://github.com/klaviyo/magento2-klaviyo/pull/87

njparadis commented 3 years ago

Released with version 2.0.0