Skip to content
MDView as Markdown

Adyen

Adyen is unusual among payment providers in publishing its CSP guidance as part of a PCI DSS compliance guide rather than as an integration footnote. Their script security page maps directly onto Requirements 6.4.3 and 11.6.1, and recommends collecting violation reports at an endpoint - which is exactly the control those requirements are asking for.

What Adyen recommends

  • Allow internally-loaded scripts by default, then expressly allow scripts from non-internal domains.
  • Trusted sources for their integrations include *.adyen.com plus the domains for the wallets and schemes you have enabled: pay.google.com, *.payments-amazon.com, *.paypal.com, *.ratepay.com, *.cash.app, and *.mastercard.com and *.visa.com for Click to Pay.
  • For iframes, Adyen recommends a wildcard to accommodate 3D Secure authentication, which is exempt from Requirement 6.4.3.
  • The report-to directive with a Reporting-Endpoints header for sending violation reports to a collector.

Sending reports to Report URI

Adyen's guidance uses the Reporting API. Your endpoint URL comes from the Setup page:

Reporting-Endpoints: csp-endpoint="https://abc123.report-uri.com/r/d/csp/reportOnly"
Content-Security-Policy-Report-Only: script-src 'self' *.adyen.com; report-to csp-endpoint

See our Reporting API guide for the full setup, and keep the older report-uri directive alongside report-to for browsers that have not moved over.

Things to watch for

  • The domain list depends on which payment methods you have enabled. Turning on a new wallet in the Customer Area can start generating violations on a policy that was clean the day before.
  • The 3D Secure exemption in 6.4.3 covers the issuing bank's ACS pages, whose URLs vary by issuer and change regularly. That is why a wildcard is recommended for iframes rather than an enumerated list.
  • 11.6.1 asks for detection of unauthorised change to headers and script content, not just a policy. Policy Watch and Script Watch cover that half, and our PCI DSS 11.6.1 guide explains how the pieces fit together.

Official documentation

Adyen - Script security for ecommerce

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial