Merge pull request #44 from moreonion/csp

feat: Implement hook_d7csp_hosts()
moreonion · Nov 25, 2024 · d9730c3 · d9730c3
2 parents 5755ef7 + 77ecd91
commit d9730c3
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/stripe_payment.module b/stripe_payment.module
@@ -436,3 +436,14 @@ function _stripe_payment_validate_comma_separated_keys($element, &$form_state, $
   $keys = array_map('trim', explode(',', $element['#value']));
   form_set_value($element, $keys, $form_state);
 }
+
+/**
+ * Implements hook_d7csp_hosts().
+ */
+function stripe_payment_d7csp_hosts() {
+  $hosts['script-src'][] = 'https://js.stripe.com';
+  // Likely needed for 3DS iframes. Those are provided by the banks.
+  $hosts['frame-src'][] = '*';
+  $hosts['form-action'][] = '*';
+  return $hosts;
+}