Remove wildcard sources from script-src on Shopify

Why it matters

A script-src that allows *, http:, https: or data: lets an attacker load a script from any server they control, so the policy does not stop script injection. List the exact hosts you use, or switch to nonces with 'strict-dynamic'.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Shopify's own header has no fetch directives, so this policy comes from a meta http-equiv Content-Security-Policy tag in your theme (layout/theme.liquid or a snippet it renders) or from an app. In Online Store, Themes, Edit code, search for Content-Security-Policy; if an app prints the tag, ask its developer.
2. Stage 1: duplicate the theme, replace the wildcard in script-src with the hosts the store loads scripts from (Shopify's CDN, your apps, analytics), and preview the copy with the developer console open on the home, product, collection and cart pages.
3. Stage 2: publish the copy once nothing the store needs is blocked. Apps add script hosts when they are installed or updated, so check again after app changes.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax