Mollie¶

Mollie's CSP requirement is refreshingly short - three lines - and their documentation goes further than most by actively telling merchants to run a strict CSP on their checkout in the first place.

What Mollie requires¶

Mollie Components loads from a single domain:

script-src - js.mollie.com
frame-src - js.mollie.com
style-src - 'unsafe-inline'

That is the whole list. Because Components renders the card fields in an iframe served from Mollie's own origin, the card data never touches your page - which is also why the frame-src entry is not optional.

Sending reports to Report URI¶

Add the reporting directives to your policy, and set the two Reporting API headers that report-to sends through. Your URLs come from the Setup page:

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' js.mollie.com 'report-sha256'; frame-src js.mollie.com; style-src 'self' 'unsafe-inline'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default
Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Things to watch for¶

style-src 'unsafe-inline' is required for Components to style its fields. It is a genuine weakening of the policy, so keep it on style-src only - an 'unsafe-inline' that ends up applying to scripts undoes most of what the policy is for.
A short vendor list is not a short policy. Mollie is three lines; the rest of your checkout - analytics, chat widgets, tag managers - is where the reports will actually come from.
Mollie's own guidance is to run a strict CSP on checkout. Report-only first is how you get there without breaking a payment page.

Official documentation¶

Mollie - Mollie Components

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial