Stripe.js with CSP Foundry
The Stripe.js preset is selected. Its sources are taken from Stripe's integration security guide and linked below the checkboxes.
- Select Stripe.js (and Stripe Checkout if you embed it).
- Add the preset to your base policy and keep Report-Only on.
- Run a test payment in Stripe test mode, including a 3D Secure card, and check the reports.
- Enforce only after the checkout flow reports nothing.
What to know
Stripe documents the directives for Stripe.js: script-src with https://js.stripe.com and https://*.js.stripe.com, frame-src with the same plus https://hooks.stripe.com, and connect-src with https://api.stripe.com. The wildcard js.stripe.com subdomain lets Stripe.js start frames on different origins for performance. hooks.stripe.com matters when a payment method redirects, such as 3D Secure or iDEAL.
Embedded Checkout uses https://checkout.stripe.com for scripts, frames and connections plus https://*.stripe.com for images. Stripe Link adds link.com origins, and the Address Element with your own Google Maps key adds maps.googleapis.com. Because the payment flow is where a broken policy costs money, test the full flow in Report-Only first.
Stripe also asks merchants whether a Content-Security-Policy is deployed as part of its security and compliance questions, so a working policy is useful beyond XSS protection. Treat that as context, not a guarantee of compliance: CSP is one control among many.
Updated · Cosmovex
Questions
What CSP does Stripe.js need?
script-src and frame-src with https://js.stripe.com and https://*.js.stripe.com, frame-src also https://hooks.stripe.com, and connect-src https://api.stripe.com, as listed in Stripe's security guide.
Why is hooks.stripe.com needed?
Payment methods that redirect, such as 3D Secure authentication or iDEAL, open a frame from hooks.stripe.com. Without it those payments fail silently.
Does Stripe Checkout need different directives?
Yes: https://checkout.stripe.com in script-src, frame-src and connect-src, and https://*.stripe.com in img-src.
Will a CSP make me PCI compliant?
No. CSP limits what scripts can run on your page, which helps protect payment pages, but PCI compliance covers much more. Follow Stripe's guidance and your assessor's requirements.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
