LokiCheckout_Csp

This module is available free of charge as part of the Loki Checkout Open Source plan. Please note that support for this module is not to be taken for granted though. If you want our dedicated help, opt for a paid plan instead.
Core
module.plan-free
Professional
Standard
Trial
PHP 8.2 - 8.5
Magento 2.4.6 - 2.4.9
CSP Yes
Unit Tests 10
PHPStan 3
Magento PHPCS 7
License OSL-3.0
Latest Release 2.0.14

This Magento 2 module is an add-on package for enforcing the CSP Restrictive Mode in the checkout, including the Alpine CSP Build and removing the unsafe-inline and unsafe-eval policies. This is required to be fully compliant with PCI DSS v4.

Note that we develop our core with this module enabled at all times, which ensures that the Loki Checkout is CSP compliant at all times.

Installation

Install this package via composer:

composer require loki-checkout/magento2-csp

Next, enable this module:

bin/magento module:enable LokiCheckout_Csp

Usage notes

Note that this module only covers CSP rules for the LokiCheckout extensions. Your theme still requires work as well to work together with the no-unsafe-inline and no-unsafe-eval policies.

When the Loki Checkout is enabled, this module enforces the CSP (no report-only mode) on the checkout page and removes unsafe-inline and unsafe-eval from script-src. This applies to every theme. Because of this, the following is required:

  • Hyvä: Use the CSP theme Hyva/default-csp (or a child theme of it). The regular Hyva/default theme loads an Alpine.js build that requires unsafe-eval and stops working in the checkout.
  • Luma: This module replaces Alpine.js with the Alpine CSP build in Luma-based themes (themes inheriting from Magento/blank). However, the Luma header still contains Knockout UI components (like the customer greeting), which Knockout and mage/utils/template.js parse with eval. These widgets break in the checkout, with errors like EvalError: Unable to parse bindings. Remove them from the checkout layout of your theme.
  • Other themes (Breeze, themes not inheriting from Magento/blank) and MageOS_AlpineLoader: The Alpine CSP build of this module is not loaded there, so make sure that your theme loads an Alpine CSP build itself.

Magento 2.4.6 does not support CSP settings per page. With 2.4.6, this module therefore overrides the global storefront CSP settings, but only for the checkout page.

Current status

Magento 2 DI compilation success
Magento 2 Integration Tests success
Playwright test success
Magento 2 Unit Tests success
Magento 2 Static Tests success

Support

For getting support, create an Issue under the following project URL:

https://github.com/LokiCheckout/LokiCheckout_Csp

Module Dependencies

The following dependencies are declared in the module its `etc/module.xml` file:

LokiCheckout_Core Loki_Base Loki_Components Loki_CssUtils Loki_FieldComponents Magento_AdminNotification Magento_Backend Magento_Catalog Magento_CatalogInventory Magento_Checkout Magento_CheckoutAgreements Magento_Cms Magento_Config Magento_Csp Magento_Customer Magento_Directory Magento_Eav Magento_Indexer Magento_Newsletter Magento_Payment Magento_Quote Magento_Rule Magento_Sales Magento_SalesRule Magento_SalesSequence Magento_Shipping Magento_Store Magento_Tax Magento_Theme Magento_Ui Magento_User Magento_Variable Magento_Vault Magento_Widget Yireo_CspUtilities
Composer details
Magento module name
LokiCheckout_Csp
Composer name
loki-checkout/magento2-csp
Composer version
2.0.13
Default branch
main
Requirements
loki/magento2-base: ^1.2
loki/magento2-components: ^2.7
magento/framework: ^103.0
magento/module-csp: ^100.4
magento/module-store: ^101.1
php: >=8.2 <8.6
yireo/magento2-csp-utilities: ^1.0
Releases
2.0.14 11 November 2026
2.0.13 11 November 2026
2.0.12 11 November 2026
2.0.11 11 November 2026
2.0.10 11 November 2026
2.0.9 11 November 2026
2.0.8 11 November 2026
2.0.7 11 November 2026
2.0.6 11 November 2026
2.0.5 11 November 2026
2.0.4 11 November 2026
2.0.3 11 November 2026
2.0.2 11 November 2026
2.0.1 11 November 2026
2.0.0 11 November 2026
1.0.5 11 November 2026
1.0.4 11 November 2026
1.0.3 11 November 2026
1.0.2 11 November 2026
1.0.1 11 November 2026
1.0.0 11 November 2026
Changelog

[2.0.13] - 30 October 2026

Fixed

  • Enforce restrictive mode via correct config path
  • Restrict inline script nonces to checkout allowlist
  • Fix Hyva x-html issue

Security

  • Stop adding CSP nonces to the messages block, which could allow injected scripts to run
  • Only add CSP nonces on the checkout page when Loki Checkout is enabled
  • Fix config path used to force CSP restrictive mode in the checkout
  • Resolve Loki Checkout enabled flag per scope instead of once per process
  • Merge checkout script policy recursively so checkout-specific hosts are kept

[2.0.12] - 11 August 2026

Fixed

  • Re-enable original Alpine CSP build for Hyva Themes

[2.0.11] - 07 August 2026

Fixed

  • Drop custom Alpine CSP with Hyva CSP-theme
  • Upgrade Alpine to 3.15.12

[2.0.10] - 12 January 2026

Fixed

  • Check for AlpineJS loader block instead of module being enabled
  • Copy generic CI/CD files

[2.0.9] - 02 December 2025

Fixed

  • Enable CSP on-the-fly to allow for disabling under Luma Checkout

[2.0.8] - 21 November 2025

Fixed

  • Allow compatibility with MageOS_AlpineLoader
  • Replace $block->getChildHtml() with $childRenderer->all() including better sorting

[2.0.7] - 14 November 2025

Fixed

  • Upgrade Alpine CSP to 3.15.1
  • Update composer keywords
  • Update composer keywords
  • Update composer keywords
  • Update README

[2.0.6] - 16 September 2025

Fixed

  • Rename loki-components.alpinejs to loki.alpinejs

[2.0.5] - 28 August 2025

Fixed

  • Add CI files
  • Replace yireo/opensearch with yireo/opensearch-dummy in Gitlab CI

[2.0.4] - 26 August 2025

Fixed

  • Rename Alpine CSP template
  • Load Alpine Mask under Luma properly
  • Add GitLab CI files

[2.0.3] - 21 August 2025

Fixed

  • Add defer back to Alpine CSP loadig
  • Fix newlines after comments
  • Add escaping of template code
  • Remove defer from Alpine to load things faster

[2.0.2] - 19 August 2025

Fixed

  • Lower requirements to PHP 8.1

[2.0.1] - 07 August 2025

Fixed

  • Lower PHP requirement to PHP 8.2+

[2.0.0] - 22 July 2025

Fixed

  • Bump LokiCheckout_Core to 2.0.0
  • Rename PHP namespace from Yireo_Loki* to Loki*
  • Rename composer package from yireo/magento2-loki* to loki/magento2*

[1.0.5] - 08 July 2025

Fixed

  • Generate new MODULE.json with simple test count
  • Allow PHP 8.4 in CI

[1.0.4] - 28 April 2025

Fixed

  • Properly add CSP to Luma-themes

[1.0.3] - 25 April 2025

Fixed

  • Allow upgrading to LokiFieldComponents and LokiCheckout 1.0
  • Update Alpine CSP built

[1.0.2] - 08 April 2025

Fixed

  • Housekeeping

[1.0.1] - 22 February 2025

  • Change deps
  • Add proper README
  • Replace TODO.md with TODO.json

[1.0.0] - 21 January 2025

  • Add proper deps
  • Initial release

Last modified: June 1, 2026