Payments in compliance with Content Security Policy (CSP)

Content Security Policy (CSP) is a security standard used in web browsers to protect against malicious attacks, including cross-site scripting (XSS) and data injection attacks. When complying with CSP, you define which content sources are trusted, and the browser blocks access to any sources not on the allowlist. If the payment UI is opened in an iframe, 3-D Secure verification fails due to CSP restrictions.

To ensure a secure and seamless payment flow, pass true in the settings.ui.is_three_ds_independent_windows parameter when getting a token. In this case, the payment UI will display an intermediate payment step, and the 3-D Secure verification will open in a new browser tab. The intermediate step is required to verify the security of the payment step and proceed to 3-D Secure verification from an iframe.

Payment flow compliant with CSP in the browser:

1. The user opens the payment UI to make a payment.
2. The user enters their payment details and clicks Pay.

3. The intermediate step opens, and the user clicks Pay one more time.

4. The user is redirected to a new browser tab to pass the 3-D Secure verification.
5. The user is redirected to the successful payment status page.