UPSTREAM FIX

magento2-39672: Theme csp_whitelist.xml is not seen on the storefront if admin is hit first

Community fix magento2-39672 merged into magento/magento2 on 2025-04-29, released in 2.4.9; applies cleanly to 33 releases from 2.4.6 to 2.4.8-p5.

Theme csp_whitelist.xml is not seen on the storefront if admin is hit first edited

Pull request title: Putting csp_whitelist.xml in theme does not work and creates intermittent issue
Pull request: magento/magento2#39672
Issues: #38933 human
Author: @NitrogenUA
Merged: 2025-04-29
Fixed in: 2.4.9
Reported on: 2.4.7
Categories: —
Components: magento/module-csp

Labels

Area: Content / CMS
Component: Csp
Priority: P2
Severity: —
Reported on (labels): 2.4.7

Issue

Title and steps come from the upstream issue and pull request.

Description

If admin is hit first after cache flush, domains under your csp_whitelist.xml under theme are not seen on frontend.

Steps to reproduce

* Put csp_whitelist.xml under your frontend theme's etc/ directory. (You can put this in Luma theme too. Just any theme will work)
* Clear your cache
* Without doing anything else Open your admin page
* now open frontend and check csp headers

Expected result

Domains listed in your custom csp_whitelist.xml under theme should have reflected on frontend

Actual result

If admin is hit first after cache flush, domains under your csp_whitelist.xml under theme are not seen on frontend.

Taken from the upstream issue.

Code match per tag

Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.

Line	Code match per tag	Tests
2.4.6	2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean	2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data
2.4.7	2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean	2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: test could not run before the patch, passes afterunit: could not run before, passes after
2.4.8	2.4.8 clean 2.4.8-p1 clean 2.4.8-p2 clean 2.4.8-p3 clean 2.4.8-p4 clean 2.4.8-p5 clean	2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: test could not run before the patch, passes afterunit: could not run before, passes after
2.4.9	2.4.9 conflictcontains the fix	2.4.9: no test data

Triage

Model @cf/cloudflare/clef. Probability this is a bug fix: 97.6%. Probability it is security relevant: 60.4%.

Show the model's answers and probabilities

Question	Answer	Probabilities	Confidence
Change kind	bugfix	bugfix 95.2%, refactor 2.1%, feature 1.1%, tests_only 0.9%, dependency 0.4%, docs_only 0.3%	88.8%
Area	framework	framework 53.3%, frontend 21.5%, other 14.6%	26.2%
Reported version	2.4.7	2.4.7 54.8%, 2.4.7-p7 2.5%, 2.4.7-p1 2.1%	29.6%
Scope	1.01 of 2	1 41.0%, 2 30.3%, 0 28.8%	1.3%
Risk	0.52 of 2	0 53.0%, 1 42.0%, 2 5.0%	19.0%
Worth backporting	1.56 of 2	2 66.4%, 1 23.2%, 0 10.4%	25.8%

Download

For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-39672/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.

Bundle README (what the ZIP ships)

# magento2-39672

Community fix merged upstream into magento/magento2, adapted by magento.watch.
This is not a patch published by Adobe.

Pull request: https://github.com/magento/magento2/pull/39672
Issue: https://github.com/magento/magento2/issues/38933
Author: @NitrogenUA
Source commit: 68474564e30ceda13e0d9e9c163ab1843778416d
Modifications: test files and documentation removed, paths rewritten relative to each Composer package.
Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code.
Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)

Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.