README

由 CTI Digital 创建的 Magento 2 模块，用于通过管理面板创建和维护内容安全策略。

安装

• composer require ctidigital/magento2-csp-whitelist
• php bin/magento module:enable CtiDigital_CspWhitelist
• php bin/magento setup:upgrade

使用方法

确定被内容安全策略阻止的资源

Refused to load https://#/analytics.js because it does not appear in the script-src directive of the Content Security Policy.

1. 注意资源 google-analytics.com 或 *.google-analytics.com。
2. 检查它违反了哪个策略 script-src。
3. 导航到管理面板 商店->配置->CTI->CSP 白名单
4. 确保模块已启用。添加新行，选择资源并添加值。
5. 保存并刷新相关缓存。

策略

POLICY NAME	DESCRIPTION
default-src	The default policy.
base-uri	Defines which URLs can appear in a page’s <base> element.
child-src	Defines the sources for workers and embedded frame contents.
connect-src	Defines the sources that can be loaded using script interfaces.
font-src	Defines which sources can serve fonts.
form-action	Defines valid endpoints for submission from <form> tags.
frame-ancestors	Defines the sources that can embed the current page.
frame-src	Defines the sources for elements such as <frame> and <iframe>.
img-src         Defines the sources from which images can be loaded.
manifest-src	Defines the allowable contents of web app manifests.
media-src	Defines the sources from which images can be loaded.
object-src	Defines the sources for the <object>, <embed>, and <applet> elements.
script-src	Defines the sources for JavaScript <script> elements.
style-src	Defines the sources for stylesheets.