Open tingyeeh opened 2 months ago
Solution:
Initially, modifying Nginx's CSP settings did not resolve the issue because Magento manages CSP internally. The correct approach was to add the external script's source to Magento's CSP whitelist by modifying the csp_whitelist.xml
file. Here is the configuration we added:
<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
<policies>
<policy id="script-src">
<values>
<value id="cdnjs-cloudflare" type="host">https://cdnjs.cloudflare.com</value>
</values>
</policy>
</policies>
</csp_whitelist>
After adding this configuration, we cleaned the cache and redeployed the static content:
bin/magento cache:clean
bin/magento setup:static-content:deploy -f
This resolved the CSP violation issue.
Title
Content Security Policy (CSP) Conflict When Using Content Constructor CMS
Description
While using the Content Constructor CMS, we encountered a Content Security Policy (CSP) issue. The problem arises when trying to load an external script from
cdnjs.cloudflare.com
, resulting in a CSP violation reported by the browser.Reproduction Steps
Configure the Nginx server with the following security headers:
Use the Content Constructor CMS and attempt to load the script
https://cdnjs.cloudflare.com/ajax/libs/vue-resource/0.9.3/vue-resource.js
.Expected Behavior
The script should load without any CSP violation errors, allowing the CMS to function correctly.
Actual Behavior
The browser reports a CSP violation error with the following message:
Environment
Additional Information
nginxconfig.io/security.conf
and other included files do not set additional CSP headers.By submitting this issue, we hope to get insights into the potential conflict causing the CSP violation and possible resolutions. Thank you for your assistance.![image](https://github.com/magesuite/magesuite/assets/15965783/d450e69d-a1cd-4a33-b664-64a79b623d57)