CSP error in donate site

[cdanfon]

Following completion of tickets #1677 & #1673 the Digital Marketing team at TBX have tested the changes.

An error is showing in the console for https://donate-wagtail.mofostaging.net/en-GB/

See attached

[danielfmiranda]

Hi Everyone! Just wanted to leave some findings from @mtdenton and I here for whoever works on this ticket.

It turns out, these 3 errors are not being generated by our code, but instead by a random inline script (that has no effect on the functionality of payment processing) that is being used by the braintree/paypal package.

Since these files are used in the package themselves, there is no way for us to access these and pass in the nonce value.

According to documentation, if we upgrade braintree/paypal, we can then load in the paypal sdk manually like so:

<!-- Load the PayPal JS SDK -->
<script src="https://www.paypal.com/sdk/js?client-id=your-sandbox-or-prod-client-id"></script>

<!-- Load the Braintree components -->
<script src="https://js.braintreegateway.com/web/3.85.3/js/client.min.js"></script>
<script src="https://js.braintreegateway.com/web/3.85.3/js/paypal-checkout.min.js"></script>

Which according to the paypal documentation , we can then pass in the nonce like so:

<script src="https://www.paypal.com/sdk/js?client-id=test" data-csp-nonce="xyz-123">

However, this would be a significant effort and like mentioned above, nothing is broken with the payment processing, so we are going to put off the upgrade until needed

[cdanfon]

Hey @danielfmiranda this is great, thanks for adding the above explanation.

Further to your comment below, feels like this can be put on hold for the time being and reviewed in the future

However, this would be a significant effort and like mentioned above, nothing is broken with the payment processing, so we are going to put off the upgrade until needed

[cdanfon]

The question/discussion is: do we want to invest time fixing this?

[bheasman]

I think the issue here is less that it's breaking payments, but rather it's blocking GA which preventing us from setting up the donation funnel tracking in GA4. So I do think it'd be good to make a plan for this, unless there's a workaround that doesn't involve the Paypal/braintree upgrade (which seems a high effort approach, is that right @danielfmiranda ?)

[cdanfon]

completed via #1673