Open source Magento 2 module
CSP whitelist from the admin
A new tracking script, payment provider or chat gets blocked by Magento's Content Security Policy. With the module you add the host from the admin – safely and without a deploy.
Softcode_CspWhitelist · v2.0 · MIT
For you if you…
- regularly add tracking, payment or chat
- want to add a host without a deploy
- want to keep the CSP tight
What it solves
- Every new third-party service needs a developer and a deploy
- Scripts are blocked in production and nobody knows why
- Quick fixes open the CSP wider than needed
Features
Hosts per directive
script-src, style-src, img-src, connect-src and more – from the admin.
Validated on save
Unsafe values such as *, http:, data: and 'unsafe-inline' are rejected with a reason.
No hidden hosts
The module never adds hosts itself – only what you enter.
Leaves your CSP mode alone
Only adds your hosts to the merged policy; Magento's own settings are kept.
Security first
CSP is a security control, so every host is validated and normalised before it is saved, and access is controlled by an ACL role.
Requirements
- Magento
- 2.4.6 – 2.4.8
- PHP
- 8.1 – 8.4
- Licence
- MIT
Installation
With Composer from Packagist:
composer require softcode/module-csp-whitelist:^2.0 bin/magento module:enable Softcode_CspWhitelist bin/magento setup:upgrade bin/magento setup:di:compile bin/magento cache:flush
Questions about the module
Can the module open the CSP too wide?
The module rejects values such as *, http:, data: and 'unsafe-inline', and every host is validated before it is saved.
Who may edit the list?
Access is controlled by an ACL role in the admin.
Need your CSP tightened?
Questions about the module, or need it adapted to your shop? We are happy to install and adapt it.