-
Notifications
You must be signed in to change notification settings - Fork 9.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The Content-Security-Policy directive 'frame-ancestors' does not support the source expression ''unsafe-inline'' #33101
Comments
Hi @minhluan259. Thank you for your report.
Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:
For more details, please, review the Magento Contributor Assistant documentation. Please, add a comment to assign the issue:
🕙 You can find the schedule on the Magento Community Calendar page. 📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket. 🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel ✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel |
Seem you have add whitelist csp to your external resources. Otherwises browser will raise error like that |
@magento give me 2.4-develop instance |
Hi @TheRealHunzik. Thank you for your request. I'm working on Magento instance for you. |
Hi @TheRealHunzik, here is your Magento Instance: https://417250d6ae3dad506caa89980d793a88-2-4-develop.instances.magento-community.engineering |
@mrtuvn it's not about whitelist issue, because on default luma theme we do not have any iframe (object, embed, ... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors ) tags. |
Hi @engcom-Echo. Thank you for working on this issue.
|
Hi Minhluan259, Please refer the devdocs link - https://devdocs.magento.com/guides/v2.4/extension-dev-guide/security/content-security-policies.html Hope this link will help you resolve this issue that you are getting. Let me know , if the information does not suffice your query. Thanks |
@engcom-Echo please read this:
|
I'm in agreement with @minhluan259 - the issue is happening because The issue is reported as an error in console starting in Chrome v91. |
I have not fully tested this, but changing line https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/Csp/etc/config.xml#L109 to |
Having the same issue on 2.4.2, Chrome 91.0.4472.77. @refueledinc's solution worked, but instead of doing it on the core file I added a section to my custom CSP extension |
This is how mine looks:
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
<default>
<csp>
<mode>
<storefront>
<report_uri>https://yoururl.com/</report_uri>
</storefront>
<admin>
<report_uri>https://yoururl.com/</report_uri>
</admin>
</mode>
<policies>
<storefront>
<frame-ancestors>
<policy_id>frame-ancestors</policy_id>
<self>1</self>
<inline>0</inline>
<eval>0</eval>
<dynamic>0</dynamic>
</frame-ancestors>
</storefront>
</policies>
</csp>
</default>
</config>
…On Thu, Jun 3, 2021 at 9:53 AM kunzi ***@***.***> wrote:
Having the same issue on 2.4.2, Chrome 91.0.4472.77. @refueledinc
<https://github.com/refueledinc>'s solution worked, but instead of doing
it on the core file I added a section to my custom CSP extension
Could you share your file as I could not get this fix to work in my custom
module's config.xml?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#33101 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AHZMN4SV3BQCW2KE3NDDFXTTQ6XRLANCNFSM45ZSOOGQ>
.
|
this help for me too |
@jmonrove @pathakkrunal what is the solution? I think the repository not exists anymore.. |
@refueledinc and @jmonrove solution is working.
|
@m2-community-project[bot] Thank you for verifying the issue. Unfortunately, not enough information was provided to acknowledge ticket. Please consider adding the following:
Once all required information is added, please add label |
@m2-community-project[bot] Thank you for verifying the issue. Unfortunately, not enough information was provided to acknowledge ticket. Please consider adding the following:
Once all required information is added, please add label |
✅ Confirmed by @engcom-Hotel Issue Available: @engcom-Hotel, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself. |
@magento-engcom-team how come you agree that disabling security enhancements "fixes the issues" instead of guiding the community on how to create implementation that make use of your own SECURITY POLICIES? |
2.4.3 affected logged in every page to console
|
So why this is closed while this error occurs ? :) I just checked a random site with magento 2.4.2 demo and it seems the error appears there |
Per the last comment, a fix was merged in with PR #33202 into the
2.4-develop branch. This means that it was fixed upstream (in a release
branch) so it is resolved in all future versions of M2. To pull this into
an older version like 2.4.2, you can create a diff patch to apply it to
your store.
…On Thu, Sep 23, 2021 at 6:43 AM Chris ***@***.***> wrote:
So why this is closed while this error occurs ? :) I just checked a random
site with magento 2.4.2 demo and it seems the error appears there
https://demo-m2.bird.eu/
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
<#33101 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AADKWJL5SSJZ2QCKN4TIIQDUDMAG7ANCNFSM45ZSOOGQ>
.
|
What also helps is deactivating the Csp module altogether: |
I see alot of downvotes, basically because: What you actually inadvertently do when you disable the module, is to completely disable a new security feature created by Magento core, from the official documentation a better explanation than I can:
https://devdocs.magento.com/guides/v2.4/extension-dev-guide/security/content-security-policies.html Perhaps you should try to look at re-enabling |
@magento give me 2.4-develop instance |
Hi @gvasilakiss. Thank you for your request. I'm working on Magento instance for you. |
Hi @gvasilakiss, here is your Magento Instance: https://417250d6ae3dad506caa89980d793a88-2-4-develop.instances.magento-community.engineering |
Preconditions (*)
Steps to reproduce (*)
Expected result (*)
Actual result (*)
The Content-Security-Policy directive 'frame-ancestors' does not support the source expression ''unsafe-inline''
How to solve 'frame-ancestors' issue?
The text was updated successfully, but these errors were encountered: