Skip to content
MDView as Markdown

Adobe Commerce

Adobe Commerce and Magento Open Source have shipped native CSP support since 2.3.5 through the Magento_Csp module. You do not need an extension and you do not need to hand-write the header - the platform builds the policy for you and gives you a place to put your reporting endpoint.

Storefront and Admin are configured separately, which is worth knowing before you start wondering why a change had no effect on the page you were looking at.

What Adobe Commerce gives you

  • Two modes per area: report-only, where violations are reported but nothing is blocked, and restrict, where the browser enforces the policy. From 2.4.7 payment pages default to restrict and everything else defaults to report-only.
  • csp_whitelist.xml for adding trusted domains to individual directives (script-src, style-src, font-src and the rest), or for allowing specific inline scripts and styles by SHA-256 hash.
  • A CSP nonce provider from 2.4.7, so inline scripts can be allowed without 'unsafe-inline'.
  • Mode switching in config.xml via the report_only values, including per-page configuration.

Sending reports to Report URI

Set your reporting endpoint in the Admin under Stores > Configuration > Security > Content Security Policy, or set it programmatically in config.xml. Your URL comes from the Setup page in your account and looks like this:

https://abc123.report-uri.com/r/d/csp/reportOnly

Reports are sent in both modes, so you keep getting data after you switch a page from report-only to restrict. Use the reportOnly endpoint while a page is in report-only mode and the enforce endpoint once it is enforcing, so the two data sets stay separate in your account.

Things to watch for

  • Because payment pages default to restrict from 2.4.7 while everything else defaults to report-only, an upgrade can start blocking on checkout before you have tuned the policy. Review those pages first.
  • Third-party extensions frequently inject their own scripts. Each one needs an entry in csp_whitelist.xml, and your CSP reports are the fastest way to find the ones nobody documented.
  • Hashes in csp_whitelist.xml break whenever the inline script changes by a single character. Prefer the nonce provider on 2.4.7 and above.

Official documentation

Adobe Commerce - Content security policies

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Working towards PCI DSS 4.0 on your checkout? See our Compliance guides.

Start your free trial