Closed MyHouseIsBig closed 1 year ago
Hey @MyHouseIsBig, thanks for filing an issue. If you use a Content Security Policy it must be configured to allow Stripe.js: https://stripe.com/docs/security/guide#content-security-policy
Relevant issue: https://github.com/stripe/stripe-js/issues/244
Please feel free to reopen this issue if it is not resolved
What happened?
I followed the guide on stripe.com to correctly setup CSP but when I'm in production and trying to load the Stripe Elements form I get the following error in the browser console:
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://js.stripe.com https://maps.googleapis.com".
The following snippets are the components that are part of the payment flow and are hosted on the same route:
Deposit.jsx
StripeForm.jsx
Another error that I'm getting similar to the previous is the following:
Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='".
The difference is that this error is logged randomly sometimes even when I'm not on the
/deposit
route.Environment
Brave Browser 1.47.186 Chromium: 109.0.5414.119 On Win10 21H1 19043.1237
Reproduction
No response