{"data":{"id":"magento2-39672","source":"github-pr","sourceRef":"magento/magento2#39672","title":"Putting csp_whitelist.xml in theme does not work and creates intermittent issue","pr":{"number":39672,"url":"https://github.com/magento/magento2/pull/39672","author":"NitrogenUA","mergedAt":"2025-04-29T18:55:01Z","mergeCommit":"0c70667d301cd839d8796f8c0772286b0812a114","headCommit":"68474564e30ceda13e0d9e9c163ab1843778416d","baseRef":"2.4-develop","diffSha256":"3e89cb076f2deed0816c391b017849924f1d52c992d1e171e2d490d3b05dba93"},"issues":[{"number":38933,"url":"https://github.com/magento/magento2/issues/38933","title":"Putting csp_whitelist.xml in theme does not work and creates intermittent issue","labels":["Area: Content / CMS","Component: Csp","Issue: Confirmed","Priority: P2","Progress: done","Reported on 2.4.7","Reproduced on 2.4.x","Triage: Dev.Experience"],"kind":"human"}],"fixedIn":"2.4.9","containingTags":["2.4.9"],"reportedOn":"2.4.7","codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"clean","2.4.8-p1":"clean","2.4.8-p2":"clean","2.4.8-p3":"clean","2.4.8-p4":"clean","2.4.8-p5":"clean","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10","2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5"],"components":["magento/module-csp"],"files":[{"path":"app/code/Magento/Csp/Model/Collector/CspWhitelistXml/FileResolver.php","change":"modified","package":"magento/module-csp"}],"stripped":{"tests":["app/code/Magento/Csp/Test/Unit/Model/Collector/CspWhitelistXml/FileResolverTest.php"],"docs":[],"outsideCode":[]},"linesChanged":51,"mergeBatched":true,"excluded":null,"sections":{"description":"If admin is hit first after cache flush, domains under your csp_whitelist.xml under theme are not seen on frontend.","stepsToReproduce":"* Put csp_whitelist.xml under your frontend theme's etc/ directory. (You can put this in Luma theme too. Just any theme will work)\n* Clear your cache\n* Without doing anything else Open your admin page\n* now open  frontend and check csp headers","expectedResult":"Domains listed in your custom csp_whitelist.xml under theme should have reflected on frontend","actualResult":"If admin is hit first after cache flush, domains under your csp_whitelist.xml under theme are not seen on frontend.","source":"issue"},"signatures":[],"labels":{"area":["Content / CMS"],"component":["Csp"],"priority":"P2","severity":null,"reportedOn":["2.4.7"]},"categories":[],"triage":{"model":"@cf/cloudflare/clef","requestHash":"dfb7e99e9225dc0d29935d4b65d4bc667ebff2a7d0bec9b8fd2d87341262a5a2","isBugfix":0.9759,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9518,"feature":0.011,"refactor":0.0214,"tests_only":0.0091,"docs_only":0.0029,"dependency":0.0038},"confidence":0.8879},"scope":{"score":1.0148,"probabilities":{"0":0.2876,"1":0.4099,"2":0.3025},"confidence":0.0134},"risk":{"score":0.52,"probabilities":{"0":0.5301,"1":0.4198,"2":0.0501},"confidence":0.1897},"area":{"choice":"framework","probabilities":{"catalog":0.0164,"checkout":0.014,"customer":0.0134,"admin":0.0529,"graphql_api":0.0102,"framework":0.5325,"frontend":0.2147,"other":0.1459},"confidence":0.2622},"securityRelevant":0.604,"reportedVersion":{"choice":"2.4.7","probabilities":{"2.4.0":0.0021,"2.4.0-p1":0.0021,"2.4.1":0.002,"2.4.1-p1":0.0021,"2.4.2":0.0023,"2.4.2-p1":0.0024,"2.4.2-p2":0.0027,"2.4.3":0.003,"2.4.3-p1":0.0028,"2.4.3-p2":0.003,"2.4.3-p3":0.0027,"2.4.4":0.003,"2.4.4-p1":0.0026,"2.4.4-p10":0.0027,"2.4.4-p11":0.0033,"2.4.4-p12":0.0034,"2.4.4-p13":0.0035,"2.4.4-p14":0.0044,"2.4.4-p15":0.0032,"2.4.4-p16":0.0036,"2.4.4-p17":0.0037,"2.4.4-p18":0.0028,"2.4.4-p2":0.0023,"2.4.4-p3":0.0023,"2.4.4-p4":0.0028,"2.4.4-p5":0.003,"2.4.4-p6":0.0036,"2.4.4-p7":0.0038,"2.4.4-p8":0.0036,"2.4.4-p9":0.0028,"2.4.5":0.0037,"2.4.5-p1":0.0026,"2.4.5-p10":0.0025,"2.4.5-p11":0.0034,"2.4.5-p12":0.0043,"2.4.5-p13":0.0037,"2.4.5-p14":0.0039,"2.4.5-p15":0.0031,"2.4.5-p16":0.0031,"2.4.5-p17":0.0036,"2.4.5-p2":0.0026,"2.4.5-p3":0.0025,"2.4.5-p4":0.0031,"2.4.5-p5":0.003,"2.4.5-p6":0.0033,"2.4.5-p7":0.0036,"2.4.5-p8":0.0028,"2.4.5-p9":0.0024,"2.4.6":0.0136,"2.4.6-p1":0.0055,"2.4.6-p10":0.0052,"2.4.6-p11":0.0075,"2.4.6-p12":0.0061,"2.4.6-p13":0.0069,"2.4.6-p14":0.0061,"2.4.6-p15":0.0049,"2.4.6-p2":0.0028,"2.4.6-p3":0.0036,"2.4.6-p4":0.005,"2.4.6-p5":0.005,"2.4.6-p6":0.0061,"2.4.6-p7":0.0073,"2.4.6-p8":0.0046,"2.4.6-p9":0.0032,"2.4.7":0.5478,"2.4.7-p1":0.0212,"2.4.7-p10":0.0134,"2.4.7-p2":0.0108,"2.4.7-p3":0.0136,"2.4.7-p4":0.0125,"2.4.7-p5":0.0134,"2.4.7-p6":0.0168,"2.4.7-p7":0.0246,"2.4.7-p8":0.0132,"2.4.7-p9":0.0101,"2.4.8":0.0064,"2.4.8-p1":0.0063,"2.4.8-p2":0.0066,"2.4.8-p3":0.0071,"2.4.8-p4":0.006,"2.4.8-p5":0.0062,"2.4.9":0.006,"unspecified":0.0198},"confidence":0.2958},"backportWorthy":{"score":1.5595,"probabilities":{"0":0.1042,"1":0.232,"2":0.6638},"confidence":0.2579}},"curated":{"title":"Theme csp_whitelist.xml is not seen on the storefront if admin is hit first","description":"If admin is hit first after cache flush, domains from csp_whitelist.xml under a frontend theme are not seen on frontend. FileResolver read theme files only for the global scope, so the global cache was populated according to Magento/backend. Theme files are now read for the frontend and adminhtml scope, not for global.","categories":[],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":{"2.4.8-p5":{"before":"not-runnable","after":"pass","adapted":false,"runAt":"2026-10-06T09:20:07.892Z","releaseCommit":"870a22c63d9d9b68fa3297962e2d5d5841115814","suites":{"unit":{"before":"not-runnable","after":"pass","runAt":"2026-10-06T09:20:07.892Z"}}},"2.4.7-p10":{"before":"not-runnable","after":"pass","adapted":false,"runAt":"2026-10-06T09:29:25.876Z","releaseCommit":"72561bf80652f57cc642a03e2c9a51d74a285b14","suites":{"unit":{"before":"not-runnable","after":"pass","runAt":"2026-10-06T09:29:25.876Z"}}}}},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-39672 details"}