Add base-uri to the Content-Security-Policy on Shopify

Why it matters

An injected base tag can make every relative script URL on the page load from an attacker's server. base-uri 'self' (or 'none') stops that and almost never breaks anything.

The fix

1. Shopify's own header has no fetch directives, so this comes from a meta http-equiv Content-Security-Policy tag in your theme (layout/theme.liquid or a snippet it renders) or from an app. In Online Store, Themes, Edit code, search for Content-Security-Policy; if an app prints the tag, ask its developer.
2. Add base-uri 'self' to the tag's content value and save.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax