Member Avatar for Steve_63

Anyone here had experience with PayPal Content Security Policy?
I tried to make a dummy purchase using Chrome Developer tools and this message is written in the bottom box: Content Security Policy blocks inline execution of scripts and stylesheets
(See attachment)
There must be a line of code to go in the <head> lurking somewhere, PayPal doesn't want to make it simple.
So, does anyone have any knowledge of this CSP? It's certainly preventing any PayPal sales that's for sure.

CSP1.png

  • 2 Contributors
  • 11 Replies
  • 329 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Steve_63
Member Avatar for Dani

Hello!

What does your Content Security Policy currently look like, and what type of PayPal integration do you have set up? Your CSP might be blocking PayPal's scripts from running or forms from executing.

Here at DaniWeb, we have some pages such as our DaniWeb Premium donation page where we have a PayPal form submission. Therefore, our content-security-policy has to look like this:

frame-ancestors 'none'; form-action 'self' https://www.paypal.com

In other words, we want DaniWeb pages to only be able to submit forms to daniweb.com domains or to PayPal.

Your CSP gets set up with an HTTP header. With PHP, I can do it as so:

header("content-security-policy: form-action 'self' https://www.paypal.com");
commented: Very helpful, the first person to come up with some kind of explanation and a solution, a big thank you! +0
Member Avatar for Dani

As I came across your recent rant about CSP, is it still giving you trouble? Can I provide more assistance?

commented: I've seen my punters (via Ms Clarity) press on the Buy Now buttons and they just don't respond, there's no pointer/hand. +0
Member Avatar for Steve_63

Following on from my comment, PayPal don't seem to mind their merchants having techie problems, their Community has a lot of questions regarding this topic, I'm not the only one.
I paid a Developer to solve it, he spent a lot of hours on my site's Apache server as he was convinced that's where the trouble lay, but I'm afraid it was still the same, I think he had to give up.
I have no idea what a CSP looks like or where it lives, apparently it runs with something called a 'nonce' - a renewable code that runs only once.
I seem to be on a mission with this problem, so yes, I'd appreciate your input totally. Steve

Member Avatar for Dani

Did adding the PHP code:

header("content-security-policy: form-action 'self' https://www.paypal.com");

to your PHP page that contains the PayPal button not fix your problem?

CSP is simply an HTTP header that gets spit out from your PHP code (or whatever other programming language you happen to be using). It doesn't really "live" anywhere, as it's not something that is installed on your server or anything like that.

If the above PHP code didn't work, please link me to the webpage that includes the PayPal button.

commented: Only just seen this Dani, I will try it tomorrow (later!) as it's nearly 3am. My sincere thanks to you +0
Member Avatar for Steve_63

I put the code you suggested in the <head> section:
(see code block)

Uploaded it, then I went to chrome developer tools, loaded my page and it came up with the red warning.
So I commented out the google tag .js & the cookie bar, re-submitted and there was no warning and the PayPal purchase was enabled, no warnings whatsoever .
Previous to your helpful code Dani, I have tried the above trick of commenting out to no avail, but with your code it seems to work.
I'm just gonna have a play around and see just who is the offender, Google or Cookie?

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="MSSmartTagsPreventParsing" content="TRUE">
    <?phpheader("content-security-policy: form-action 'self' https://www.paypal.com");?>
    <meta name="robots" content="index,follow">

I'll update . . . Steve

Member Avatar for Steve_63

Looks like it's found something else now that violates their precious CSP.
(See attatched) Steve

Google-Cookie1.png

Member Avatar for Steve_63

What I'll do is copy the page because it's a site with an Adult theme.
Then I'll send you the html.
By the way, I can make successful payments, but anyone else, no.
Maybe that gives you a clue?
Since you messaged that code and it decided not too work after all, I did some more researching, looking at the various ways in which website owners & developers have cured this, but most of it went straight over my head, so I decided not to play with fire.
I once again thank you for your help Dani, I really do appreciate it, Steve

Member Avatar for Dani

Sending me the HTML alone won't be of assistance. What I need to see are the HTTP headers of the page that is loading the Paypal script in addition to the HTML that loads the Paypal script.

If you are using Chrome, for example you can right click and choose Inspect to bring up Chrome Developer Tools. Then, load the page in question. Click the Network tab of the Developer Tools window, and in the sidebar where it says Name, choose the filename for the HTML page. It should look something like this. Be sure to show all of the Response Headers.

Attached is a screenshot I just took of DaniWeb's homepage. You can see that it shows the content-security-policy that I showed you in a previous post that I am using.

Screen_Shot_2023-02-14_at_11.06.12_AM.png 601.19 KB
Edited by Dani
Member Avatar for Dani

Also, I appreciate you not linking to adult material from DaniWeb, as we are a student-friendly community for everyone 13+.

We'll get this figured out for ya.

commented: Besides I'm conversing with a woman and I consider myself a gentleman. I wonder if I could send the html by PM, then you can decide if it's fit. +0
Member Avatar for Steve_63

Thank you Dani, I wanted to 'Save as Web Page' so you had the browser complete with the scroll bar, but I can't attach the actual folder with all the files in your mail.
There's a lot of files: General, Request & Response headers, some which are out of sight, so the scroll bar would be essential for the information you'd be needing, if I'm right?
Your .php script you kindly sent has taken out the 'Add to Cart' & the 'Review Cart' buttons, the 'Buy Now' is hosted on the Apache server
I'll attach a screen shot. Steve

response_headers.png

Member Avatar for Steve_63

Hi Dani, I've been reserching and trying time after time with different variations of <meta> tags, but there's one I found on a CSP tips n' tricks site, I tried it and it seems to be better than anything else so far.
I've attached it as it wouldn't post here.
I appreciate your help, thank you, Steve

<!DOCTYPE html>
<html lang="en">
              <!--form-action-->   <!--script-src-->                      
<head>
    <!-- Add meta tags for mobile and IE -->
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">
    <!--<meta http-equiv="Content-Security-Policy" content="form-action 'self' https://apis.google.com 'unsafe-inline' 'unsafe-eval' *paypal.com *.google.com "/>-->
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <title> PayPal Checkout Integration | Client Demo </title>
    <!--<meta http-equiv="Content-Security-Policy" content="default-src *;
   img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *;
   style-src  'self' 'unsafe-inline' *">-->
</head>
<body>
   
 wanna buy this stuff for 10p?

            click right here and be done
            
<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="Q2K4CYQ9DZURE">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_cart_LG.gif" border="0" name="submit" alt="PayPal  The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
</form>
<br>
<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post" >
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIG1QYJKoZIhvcNAQcEoIIGxjCCBsICAQExggEwMIIBLAIBADCBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQAwDQYJKoZIhvcNAQEBBQAEgYASgcpMahjBBDPUuRxZl8LRq0Rzf7SKK/ai+8eDpDb6J4ReeCfLewrnL9lCyHtaYcjUzNodHBW9yQtpmrEWaukN9yzUPsC4voAHR9/poBNmPs8j0/eK4a2Ci7ni+ISehZljr+Enlq940M1q/6m8ekprynNAXu+92wHsKM6pzB7AdTELMAkGBSsOAwIaBQAwUwYJKoZIhvcNAQcBMBQGCCqGSIb3DQMHBAijYYXtNG+wB4AwSrMav/wQuRGuWJe7ExY6dAfXwWeGg6aw/0dAAf9hkDtdeePOgS9So8h8qflG5+ZXoIIDhzCCA4MwggLsoAMCAQICAQAwDQYJKoZIhvcNAQEFBQAwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMB4XDTA0MDIxMzEwMTMxNVoXDTM1MDIxMzEwMTMxNVowgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBR07d/ETMS1ycjtkpkvjXZe9k+6CieLuLsPumsJ7QC1odNz3sJiCbs2wC0nLE0uLGaEtXynIgRqIddYCHx88pb5HTXv4SZeuv0Rqq4+axW9PLAAATU8w04qqjaSXgbGLP3NmohqM6bV9kZZwZLR/klDaQGo1u9uDb9lr4Yn+rBQIDAQABo4HuMIHrMB0GA1UdDgQWBBSWn3y7xm8XvVk/UtcKG+wQ1mSUazCBuwYDVR0jBIGzMIGwgBSWn3y7xm8XvVk/UtcKG+wQ1mSUa6GBlKSBkTCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb22CAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCBXzpWmoBa5e9fo6ujionW1hUhPkOBakTr3YCDjbYfvJEiv/2P+IobhOGJr85+XHhN0v4gUkEDI8r2/rNk1m0GA8HKddvTjyGw/XqXa+LSTlDYkqI8OwR8GEYj4efEtcRpRYBxV8KxAW93YDWzFGvruKnnLbDAF6VR5w/cCMn5hzGCAZowggGWAgEBMIGUMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2NlcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJARYNcmVAcGF5cGFsLmNvbQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwMjE4MTIyMjE5WjAjBgkqhkiG9w0BCQQxFgQUWOIuCEJ3rvvWWjjfIw0RojL5z0owDQYJKoZIhvcNAQEBBQAEgYBbgi3uwUyeFnSmAmJqnpQJ+NaBiG4xtQ2LL9TDdTxV89wDX9OLm2sQpJthsGQtGQx/zEnAALS5DulSyWtF7FeqmTMCOZkJqVlx6Kq8BXhWDGTPSwokthzYtemy8TSMr8+yfwyv6mDPt3+Qe+Z8TrG9ZLFBUKHZW0AIhkiYGIFlsQ==-----END PKCS7-----">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_viewcart_LG.gif" border="0" name="submit" alt="PayPal  The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
</form>


</body>
</html>
<!DOCTYPE html>
<html lang="en">
              <!--form-action-->   <!--script-src-->                      
<head>
    <!-- Add meta tags for mobile and IE -->
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">
    <!--<meta http-equiv="Content-Security-Policy" content="form-action 'self' https://apis.google.com 'unsafe-inline' 'unsafe-eval' *paypal.com *.google.com "/>-->
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <title> PayPal Checkout Integration | Client Demo </title>
    <!--<meta http-equiv="Content-Security-Policy" content="default-src *;
   img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *;
   style-src  'self' 'unsafe-inline' *">-->
</head>
<body>
   
 wanna buy this stuff for 10p?

            click right here and be done
            
<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="Q2K4CYQ9DZURE">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_cart_LG.gif" border="0" name="submit" alt="PayPal  The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
</form>
<br>
<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post" >
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIG1QYJKoZIhvcNAQcEoIIGxjCCBsICAQExggEwMIIBLAIBADCBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQAwDQYJKoZIhvcNAQEBBQAEgYASgcpMahjBBDPUuRxZl8LRq0Rzf7SKK/ai+8eDpDb6J4ReeCfLewrnL9lCyHtaYcjUzNodHBW9yQtpmrEWaukN9yzUPsC4voAHR9/poBNmPs8j0/eK4a2Ci7ni+ISehZljr+Enlq940M1q/6m8ekprynNAXu+92wHsKM6pzB7AdTELMAkGBSsOAwIaBQAwUwYJKoZIhvcNAQcBMBQGCCqGSIb3DQMHBAijYYXtNG+wB4AwSrMav/wQuRGuWJe7ExY6dAfXwWeGg6aw/0dAAf9hkDtdeePOgS9So8h8qflG5+ZXoIIDhzCCA4MwggLsoAMCAQICAQAwDQYJKoZIhvcNAQEFBQAwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMB4XDTA0MDIxMzEwMTMxNVoXDTM1MDIxMzEwMTMxNVowgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBR07d/ETMS1ycjtkpkvjXZe9k+6CieLuLsPumsJ7QC1odNz3sJiCbs2wC0nLE0uLGaEtXynIgRqIddYCHx88pb5HTXv4SZeuv0Rqq4+axW9PLAAATU8w04qqjaSXgbGLP3NmohqM6bV9kZZwZLR/klDaQGo1u9uDb9lr4Yn+rBQIDAQABo4HuMIHrMB0GA1UdDgQWBBSWn3y7xm8XvVk/UtcKG+wQ1mSUazCBuwYDVR0jBIGzMIGwgBSWn3y7xm8XvVk/UtcKG+wQ1mSUa6GBlKSBkTCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb22CAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCBXzpWmoBa5e9fo6ujionW1hUhPkOBakTr3YCDjbYfvJEiv/2P+IobhOGJr85+XHhN0v4gUkEDI8r2/rNk1m0GA8HKddvTjyGw/XqXa+LSTlDYkqI8OwR8GEYj4efEtcRpRYBxV8KxAW93YDWzFGvruKnnLbDAF6VR5w/cCMn5hzGCAZowggGWAgEBMIGUMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2NlcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJARYNcmVAcGF5cGFsLmNvbQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwMjE4MTIyMjE5WjAjBgkqhkiG9w0BCQQxFgQUWOIuCEJ3rvvWWjjfIw0RojL5z0owDQYJKoZIhvcNAQEBBQAEgYBbgi3uwUyeFnSmAmJqnpQJ+NaBiG4xtQ2LL9TDdTxV89wDX9OLm2sQpJthsGQtGQx/zEnAALS5DulSyWtF7FeqmTMCOZkJqVlx6Kq8BXhWDGTPSwokthzYtemy8TSMr8+yfwyv6mDPt3+Qe+Z8TrG9ZLFBUKHZW0AIhkiYGIFlsQ==-----END PKCS7-----">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_viewcart_LG.gif" border="0" name="submit" alt="PayPal  The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_GB/i/scr/pixel.gif" width="1" height="1">
</form>


</body>
</html>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.