Skip to content
MDView as Markdown

Stripe

Stripe publishes the exact directives Stripe.js needs, which makes it one of the easier integrations to bring under a CSP. The catch is that the requirements grow as you turn on more features - 3D Secure and the Address Element both add entries.

Stripe.js has to be loaded directly from Stripe's domain rather than bundled or self-hosted, so these domains are not optional.

What Stripe requires

  • script-src - https://js.stripe.com and https://*.js.stripe.com
  • frame-src - https://js.stripe.com, https://*.js.stripe.com and https://hooks.stripe.com
  • connect-src - https://api.stripe.com

Allowing *.js.stripe.com lets Stripe.js start frames on different origins where possible, which improves performance.

Two additions depending on what you use:

  • Payment methods with a redirect step, such as cards requiring 3D Secure, need https://hooks.stripe.com in frame-src.
  • The Address Element with your own Google Maps API key needs https://maps.googleapis.com in both connect-src and script-src.

If you use Trusted Types, dynamic scripts from https://js.stripe.com and https://*.js.stripe.com must be allowed.

Sending reports to Report URI

Add a reporting directive alongside the Stripe directives. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' https://js.stripe.com https://*.js.stripe.com; frame-src https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com; connect-src 'self' https://api.stripe.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

  • A policy tuned against a successful card payment often breaks the first time a payment triggers 3D Secure, because that path only touches hooks.stripe.com under challenge. Test a card that forces the challenge.
  • Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our Compliance guides cover what an assessor will expect to see.
  • Stripe's requirements change as they add features. Re-check the official page before a major integration change rather than after reports start arriving.

Official documentation

Stripe - Security at Stripe

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial