Content Security Policy directives
Content Security Policy (CSP) is a security standard introduced by the World Wide Web Consortium (W3C) to help prevent cross-site scripting (XSS), clickjacking, and other code injection attacks resulting from the execution of malicious content in a trusted web page context.
CSP is typically implemented as an HTTP response header named Content-Security-Policy, which allows you to restrict how resources such as JavaScript, CSS, fonts, images, and other content are loaded and executed by the browser. By specifying a set of directives, you can control the sources of content that the browser is allowed to load, thus mitigating the risk of content injection attacks.
CSP is supported by all modern browsers, including Chrome, Firefox, Safari, Edge, and Opera. It has been widely adopted and supported for many years. Please note that Internet Explorer does not support CSP.
The Content-Security-Policy header value consists of one or more directives, separated by semicolons. Each directive specifies a policy for a specific resource type or behavior. The directives necessary for the Fundraise Up platform to function properly are listed below:
1connect-src
2 fndrsp.net
3 fndrsp-checkout.net
4 *.fundraiseup.com
5 *.stripe.com
6 *.paypal.com // optional, for PayPal
7 *.paypalobjects.com // optional, for PayPal
8 pay.google.com // optional, for Google Pay
9 https://google.com/pay // optional, for Google Pay
10 api.addressy.com // optional, for UK based accounts
11 *.givechariot.com // optional, for DAFpay
12 *.dafpay.com // optional, for DAFPay
13
14script-src
15 *.fundraiseup.com
16 *.stripe.com
17 m.stripe.network
18 pay.google.com // optional, for Google Pay
19 *.paypal.com // optional, for PayPal
20 *.paypalobjects.com // optional, for PayPal
21 *.givechariot.com // optional, for DAFpay
22 *.dafpay.com // optional, for DAFPay
23
24frame-src
25 *.fundraiseup.com
26 *.stripe.com
27 *.paypal.com // optional, for PayPal
28 pay.google.com // optional, for Google Pay
29 *.givechariot.com // optional, for DAFpay
30 *.dafpay.com // optional, for DAFPay
31
32img-src
33 data:
34 blob:
35 *.fundraiseup.com
36 ucarecdn.com
37 *.ucarecd.net
38 pay.google.com // optional, for Google Pay
39 *.paypalobjects.com // optional, for PayPal
40
41font-src
42 *.fundraiseup.com
43 *.stripe.com
44
45style-src
46 'unsafe-inline'If your policy uses script-src-elem or default-src directives instead of relying on the script-src fallback, add *.givechariot.com there as well when using DAFpay.
Special note for payment methods using pop-ups
Some payment methods, such as Google Pay and PayPal, open a pop-up window during the payment flow. For these payment methods to function properly, the following additional CSP header needs to be set:
1Cross-Origin-Opener-Policy: same-origin-allow-popupsWithout this header, the payment pop-up may not open correctly and could display an error to the user. To ensure a smooth donation process for your supporters across all browsers, it's highly recommended to include this header when using payment methods that rely on pop-ups.