Search code examples
stripe-paymentscontent-security-policy

Stripe js script violates all the unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' and 'self' directives how it is possible?

Hello I'm trying to integrate stripe payments in my ASP.NET 8 pages project and I get this error despite I allowed the unsafe directives, lack of which could be the reason for the issue but still getting it. Does anyone have an idea what could be the problem? The issue is reporduced both in Chrome and Firefox.

The Error

My code:

<meta http-equiv="Content-Security-Policy" content="img-src data: https: http:;
 script-src-elem 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' 'self';
 style-src 'unsafe-inline' 'self';" />
Solution

  • You should set up the CSP/Content Security Policy directives recommended in the Stripe docs for Stripe.js: https://docs.stripe.com/security/guide?csp=csp-js#content-security-policy

    For help with your integration beyond that you should contact Stripe support: https://support.stripe.com/contact