Skip to content
MDView as Markdown

Adyen

Adyen is unusual among payment providers in publishing its CSP guidance as part of a PCI DSS compliance guide rather than as an integration footnote. Their script security page maps directly onto Requirements 6.4.3 and 11.6.1, and recommends collecting violation reports at an endpoint - which is exactly the control those requirements are asking for.

What Adyen recommends

  • Allow internally-loaded scripts by default, then expressly allow scripts from non-internal domains.
  • Trusted sources for their integrations include *.adyen.com plus the domains for the wallets and schemes you have enabled: pay.google.com, *.payments-amazon.com, *.paypal.com, *.ratepay.com, *.cash.app, and *.mastercard.com and *.visa.com for Click to Pay.
  • For iframes, Adyen recommends a wildcard to accommodate 3D Secure authentication, which is exempt from Requirement 6.4.3.
  • The report-to directive with a Reporting-Endpoints header for sending violation reports to a collector.

Sending reports to Report URI

Adyen's guidance uses the Reporting API. Your URLs come from the Setup page:

Reporting-Endpoints: csp-endpoint="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"csp-endpoint","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}
Content-Security-Policy-Report-Only: script-src 'self' *.adyen.com 'report-sha256'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to csp-endpoint

See our Reporting API guide for the full setup. Report-To and the older report-uri directive cover browsers that have not moved over to Reporting-Endpoints and report-to. 'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Things to watch for

  • The domain list depends on which payment methods you have enabled. Turning on a new wallet in the Customer Area can start generating violations on a policy that was clean the day before.
  • The 3D Secure exemption in 6.4.3 covers the issuing bank's ACS pages, whose URLs vary by issuer and change regularly. That is why a wildcard is recommended for iframes rather than an enumerated list.
  • 11.6.1 asks for detection of unauthorised change to headers and script content, not just a policy. Policy Watch and Script Watch cover that half, and our PCI DSS 11.6.1 guide explains how the pieces fit together.

Official documentation

Adyen - Script security for ecommerce

Start Monitoring with Report URI

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial