I'm working on a shopping website, we are using a third party package for dealing with payment, when user fills his credit card information, they are being redirected to url which is provided by package. Problem starts after this, depending on the credit card we are being connected to some other urls of different banks. Since I can not try all the credit cards to add their address to csp, is there another way for using csp with this type of sitiuation?
1 Answers
You can set Content-Security-Policy-Report-Only with a report-uri or report-to directive set to a report collecting endpoint. Depending on your traffic and the number of possible choices you will likely learn most of them after a while. This won't give you 100% of URL, and the hosts may change, but if you want to create a strict CSP this is a good option to learn about the hosts you should allow.
Related