With a growing Content Security Policies (CSP) whitelist, the problem can arise that the headers Content-Security-Policy-Report-Only and/or Content-Security-Policy become so large that they exceed the maximum permitted size of a header field, causing the web server to not process the response any further.

The CSP mechanism allows multiple policies to be specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a meta element [MDN]. Therefore, the headers can be specified more than once.

This is where the module comes into play. It implements an after method plugin for the method Magento\Csp\Model\Policy\Renderer\SimplePolicyHeaderRenderer::render, which replaces the existing CSP headers via the method \Magento\Framework\App\Response\HttpInterface::setHeader. The header is read, split so that the syntax remains valid, and replaced by the new headers. The result is a separate header for each directive, each of which should no longer exceed the maximum permitted length of the web server.

1. Install it into your Magento 2 project with composer:

   composer require basecom/magento2-csp-split-header

2. Enable module

   bin/magento setup:upgrade

These values can be updated in the system configuration under Basecom -> Content Security Policy -> Enable.

1. CSP splitting disabled

   Content-Security-Policy: default-src 'self' https://example.com; connect-src 'none'; script-src https://example.com/;                          

2. CSP splitting enabled

   Content-Security-Policy: default-src 'self' https://example.com; 
   Content-Security-Policy: connect-src 'none'; 
   Content-Security-Policy: script-src https://example.com/;                          

Please see CONTRIBUTING for details.

If you discover any security related issues, please email [email protected] instead of using the issue tracker.

The MIT License (MIT). Please see License File for more information.

© 2024 basecom GmbH & Co. KG