Skip to content
MDView as Markdown

PayPal

PayPal publishes dedicated CSP guidance for the JavaScript SDK, and it is more accommodating than most payment integrations: the SDK supports a nonce directly, so you do not have to choose between a strict policy and a working PayPal button.

Integrating through Braintree rather than the JS SDK directly? See our Braintree page - the domain list is different.

What PayPal requires

PayPal's guidance covers the same set of domains across several directives:

  • *.paypal.com
  • *.paypalobjects.com
  • *.venmo.com

These are needed in script-src, connect-src and frame-src, with child-src, img-src and style-src covering the same origins depending on which parts of the SDK you use.

The SDK also accepts a nonce through a data-csp-nonce attribute on the script tag:

<script src="https://www.paypal.com/sdk/js?client-id=test" data-csp-nonce="YOUR_NONCE"></script>

The value must match the nonce in your policy, and be regenerated for every response.

Sending reports to Report URI

Add a reporting directive alongside the PayPal directives. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' 'nonce-{random}' *.paypal.com *.paypalobjects.com; connect-src 'self' *.paypal.com; frame-src *.paypal.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

  • The Venmo domains are easy to miss because they are not obviously PayPal. If you offer Venmo as a funding source, *.venmo.com needs allowing or the button silently fails to render.
  • Passing the nonce to your own scripts but not to the SDK script tag is the usual failure. data-csp-nonce is a separate attribute from the standard nonce attribute - set both if your framework only manages the latter.
  • Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our Compliance guides cover what an assessor will expect to see.

Official documentation

PayPal - Content Security Policy

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Working towards PCI DSS 4.0? Start with our Compliance guides.

Start your free trial