Skip to content
MDView as Markdown

Braintree

Braintree publishes a full CSP configuration, split by whether you have AJAX/CORS enabled. The list is longer than most payment integrations because the components pull in PayPal, Google Pay and 3D Secure infrastructure alongside Braintree's own domains.

Integrating the PayPal JS SDK directly rather than through Braintree? That has its own guidance - see our PayPal page.

What Braintree requires

With AJAX/CORS enabled, the documented directives are:

  • script-src - js.braintreegateway.com, assets.braintreegateway.com, www.paypalobjects.com, c.paypal.com
  • style-src - 'unsafe-inline'
  • img-src - assets.braintreegateway.com, checkout.paypal.com, data:
  • child-src and frame-src - assets.braintreegateway.com, c.paypal.com, *.cardinalcommerce.com
  • connect-src - the Braintree API endpoints for your environment

Sandbox and production use different endpoints, so a policy tuned in sandbox will not necessarily work in production.

Sending reports to Report URI

Add a reporting directive alongside the Braintree directives. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' js.braintreegateway.com assets.braintreegateway.com www.paypalobjects.com c.paypal.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

  • 3D Secure breaks strict policies by design. Braintree's documentation is explicit: if you use 3D Secure, set frame-src and form-action to *. 3D Secure 2 frames the issuing bank's ACS URL, that URL varies by issuer and ACS provider and changes regularly, so no enumerated list can cover it. PCI DSS 6.4.3 exempts the 3D Secure step for the same reason.
  • style-src 'unsafe-inline' is required, which is a genuine weakening. Keep it scoped to style-src and do not let it leak into script-src.
  • Adding the PayPal Checkout, Google Pay or 3D Secure components each pulls in additional directives. A policy that was clean before you enabled a new payment method will not stay clean.

Official documentation

Braintree - Best Practices and Troubleshooting

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial