Skip to content
MDView as Markdown

Stripe

Stripe publishes the exact directives Stripe.js needs, which makes it one of the easier integrations to bring under a CSP. The catch is that the requirements grow as you turn on more features - 3D Secure and the Address Element both add entries.

Stripe.js has to be loaded directly from Stripe's domain rather than bundled or self-hosted, so these domains are not optional.

What Stripe requires

  • script-src - https://js.stripe.com and https://*.js.stripe.com
  • frame-src - https://js.stripe.com, https://*.js.stripe.com and https://hooks.stripe.com
  • connect-src - https://api.stripe.com

Allowing *.js.stripe.com lets Stripe.js start frames on different origins where possible, which improves performance.

Two additions depending on what you use:

  • Payment methods with a redirect step, such as cards requiring 3D Secure, need https://hooks.stripe.com in frame-src.
  • The Address Element with your own Google Maps API key needs https://maps.googleapis.com in both connect-src and script-src.

If you use Trusted Types, dynamic scripts from https://js.stripe.com and https://*.js.stripe.com must be allowed.

Sending reports to Report URI

Add the reporting directives alongside the Stripe directives, and set the two Reporting API headers that report-to sends through. Your URLs come from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' https://js.stripe.com https://*.js.stripe.com 'report-sha256'; frame-src https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com; connect-src 'self' https://api.stripe.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default
Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads.

Things to watch for

  • A policy tuned against a successful card payment often breaks the first time a payment triggers 3D Secure, because that path only touches hooks.stripe.com under challenge. Test a card that forces the challenge.
  • Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our Compliance guides cover what an assessor will expect to see.
  • Stripe's requirements change as they add features. Re-check the official page before a major integration change rather than after reports start arriving.

Official documentation

Stripe - Security at Stripe

Start Monitoring with Report URI

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page.

Start your free trial