Refused to load script from https://connect.facebook.net/

[yaaryvp]

v2025.4

the following line used in custom file with included common files:

<script async defer crossorigin="anonymous" src="https://connect.facebook.net/en_US/sdk.js"></script>

and returned

shop:1 Refused to load the script 'https://connect.facebook.net/en_US/sdk.js' because it violates the following Content Security Policy directive: "script-src 'self' https://www.google-analytics.com https://*.googleapis.com https://*.gstatic.com https://*.google.com *.google.com https://*.ggpht.com https://*.googleusercontent.com *.googleusercontent.com https://js.pusher.com https://cdn.tiny.cloud https://*.youtube.com 'unsafe-inline' 'unsafe-eval' blob:". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

in advanced settings I have Access-Control-Allow-Origin → *

ty

[arbei]

Config("CSP") format

Hi All, Just trying to find the format for adding a site to a control attribute in CSP. Want to add a site to the allow statement for img-src which current has as default some google sites already. I can edit the config.php file manually and add it and it works no probs but have been trying to workout how to add it via code using Config command but having no luck with the format for Config(“CSP”) and setting the allow. Any pointers appreciated. TIA Steve.

Content Security Policy configuration

v2025 onwards … Description: The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. Ref: phpmaker.dev/docs/#/tools.html?id=use-content-security-policy-csp Configuration: Add Config()->append("CSP.[directive]", "[value]"); into the “Global Code” section. Example: [directive] = img-src.allow [value]…

[yaaryvp]

Hi.
So for 2025, I need to allow souces for js like so:

Config()->append("CSP.script-src.allow", "https://connect.facebook.net");

and this goes in Server Events → Global → All PAges → Global Code

So this worked. Just wondering if I need it for specific custom page, can I limit it to that custom page?

[arbei]

You may check the current URL, e.g. ScriptName(), first.