Regarding Unknown Errors Generated In The Console

[sahebyuvrajsingh]

Hello,

I get set number of errors, in the console regarding CSP as well as the system fails to load some scripts from the directory, I have just installed the the Magento, straight out of the box, then to these errors. I just get it.

Spoiler

The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' 'unsafe-inline'; script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';' was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header.

Spoiler

[Report Only] Refused to load the script 'https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com cdn-scripts.signifyd.com www.youtube.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

And whenever I visit the create account option, one more error arises, I haven't even installed a custom theme yet, just wondering are these errors from my side or are bugs in the Magento system. Here is the link to recreate the error. 

https://dev.gulaticateringcompany.com/customer/account/create/

Spoiler

"DevTools failed to load SourceMap: Could not load content for https://dev.gulaticateringcompany.com/pub/static/version1594089824/frontend/Magento/luma/en_US/Magen...: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE"

I though I am getting this error, because I was having a setup at the localhost, but when installed it to the cpanel, getting the same errors all again, what can be the solution? Help will be really appreciated!

[Manish Mittal]

@sahebyuvrajsingh 

It seems your chrome some extension blocking and not compatible with JS

https://stackoverflow.com/questions/35002087/disable-source-maps-in-chrome-devtools

https://github.com/dequelabs/axe-core/issues/1977

Try to disable extensions and then check.

For refused to load one, Magento includes Magento_Csp module and it might not support so you can disable this module for now or just add headers as required by this module.

https://devdocs.magento.com/guides/v2.3/mrg/ce/Csp.html

[sahebyuvrajsingh]

---

@Manish Mittal wrote:

@sahebyuvrajsingh 

It seems your chrome some extension blocking and not compatible with JS

https://stackoverflow.com/questions/35002087/disable-source-maps-in-chrome-devtools

https://github.com/dequelabs/axe-core/issues/1977

Try to disable extensions and then check.

For refused to load one, Magento includes Magento_Csp module and it might not support so you can disable this module for now or just add headers as required by this module.

https://devdocs.magento.com/guides/v2.3/mrg/ce/Csp.html

---

Okay, I did that, but still the same scenario, anyways I had two extensions, iMacros and HMA Proxy, both were disabled already. Then to the problem persists. Even after deleting the extensions same console error.

[Manish Mittal · Accepted solution]

@sahebyuvrajsingh 

For refused to load one, Magento includes Magento_Csp module and it might not support so you can disable this module for now or just add headers as required by this module.

https://devdocs.magento.com/guides/v2.3/mrg/ce/Csp.html

[sahebyuvrajsingh]

---

@Manish Mittal wrote:

@sahebyuvrajsingh 

For refused to load one, Magento includes Magento_Csp module and it might not support so you can disable this module for now or just add headers as required by this module.

https://devdocs.magento.com/guides/v2.3/mrg/ce/Csp.html

---

I have already gone through these solutions, also created a custom module to report the CSP errors to a link specified, as well as create the csp_whitelist but is that a right way to do?

[Manish Mittal]

@sahebyuvrajsingh 

You have to set headers for all the refused request then only it will work or disable this core module. 

[sahebyuvrajsingh]

@Manish Mittal wrote:

@sahebyuvrajsingh 

You have to set headers for all the refused request then only it will work or disable this core module. 

---

Please throw some light, I am a newbie In this, have started using it recently, how can I do that?