Swagger Plugin cause CSP-error with Matomo Overlay

ResponsibleUser · March 23, 2026, 2:07pm

Using the Swagger Plugin with Matomo cause a CSP error with Matomo Overlay function.

Problematic code in Swagger:

config/config.php

817b432d4


      
          
          return array(
              \Piwik\View\SecurityPolicy::class => Piwik\DI::decorate(function ($previous) {
                  /** @var \Piwik\View\SecurityPolicy $previous */
          
                  if (!\Piwik\SettingsPiwik::isMatomoInstalled()) {
                      return $previous;
                  }
          
                  $previous->addPolicy('img-src', 'validator.swagger.io');
                  $previous->addPolicy('frame-src', "'self'");
                  return $previous;
              }),
          );

The “frame-src: ‘self’” cause, that the Overlay function in Matomo stops working, because Matomo’s “index.php” will be delivered with the CSP and the Browser don’t allow then to load the overaly data in the i-frame.

Matomo 5.7.1.
Swagger 5.2.3