PayPal¶

PayPal publishes dedicated CSP guidance for the JavaScript SDK, and it is more accommodating than most payment integrations: the SDK supports a nonce directly, so you do not have to choose between a strict policy and a working PayPal button.

Integrating through Braintree rather than the JS SDK directly? See our Braintree page - the domain list is different.

What PayPal requires¶

PayPal's guidance covers the same set of domains across several directives:

*.paypal.com
*.paypalobjects.com
*.venmo.com

These are needed in script-src, connect-src and frame-src, with child-src, img-src and style-src covering the same origins depending on which parts of the SDK you use.

The SDK also accepts a nonce through a data-csp-nonce attribute on the script tag:

<script src="https://www.paypal.com/sdk/js?client-id=test" data-csp-nonce="YOUR_NONCE"></script>

The value must match the nonce in your policy, and be regenerated for every response.

Sending reports to Report URI¶

Add the reporting directives alongside the PayPal directives, and set the two Reporting API headers that report-to sends through. Your URLs come from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' 'nonce-{random}' *.paypal.com *.paypalobjects.com 'report-sha256'; connect-src 'self' *.paypal.com; frame-src *.paypal.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default
Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Things to watch for¶

The Venmo domains are easy to miss because they are not obviously PayPal. If you offer Venmo as a funding source, *.venmo.com needs allowing or the button silently fails to render.
Passing the nonce to your own scripts but not to the SDK script tag is the usual failure. data-csp-nonce is a separate attribute from the standard nonce attribute - set both if your framework only manages the latter.
Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our Compliance guides cover what an assessor will expect to see.

Official documentation¶

PayPal - Content Security Policy

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial