fix(csp): allow the Stripe and Turnstile scripts - #99736
Conversation
`script-src` lists no third-party host, so two scripts the app loads itself violate our own policy. The policy is report-only, so both still run. Under enforcement, adding a payment method and the signup captcha would both fail. Over 24 hours, on documents carrying the current policy: - js.stripe.com, 90 reports across 52 documents, on /signup, the user-navigation settings page and the onboarding plans step. `PaymentEntryModal.tsx` calls `loadStripe`, which injects the script. - challenges.cloudflare.com, 14 reports across 7 documents, on /signup. `signupLogic.ts` drives the Turnstile widget, which loads the API. Neither can be self-hosted: both vendors require the file to load from their own origin, so the approach used for the country flag font does not transfer. Only `script-src` needs the two hosts. `frame-src 'self' https:` already admits the iframes each vendor opens, and neither reported a connect-src violation across those 52 documents, which says their API calls happen inside those frames rather than from our page.
|
😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details. |
🤖 CI report
|
Prompt To Fix All With AI### Issue 1
posthog/middleware.py:1336
**Missing CSP regression coverage**
The new allowlist entries are not covered by `TestCSPMiddleware`, so CI cannot detect either origin being removed before CSP enforcement breaks Stripe payments or Turnstile signup challenges. Add focused assertions that the app policy's `script-src` directive contains both exact origins; this avoids pinning the complete policy string.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "fix(csp): allow the Stripe and Turnstile..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Piccirello
added
stamphog
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved.
CSP change is security-sensitive but narrowly scoped and well-justified; author has STRONG familiarity (100% of touched lines, 160 recent merged PRs in this path) which stands in for independent assurance, and Greptile's only comment was a non-blocking test-coverage suggestion.
- Author wrote 100% of the modified lines and has 160 merged PRs in these paths (familiarity STRONG).
- 👍 on the PR from greptile-apps[bot].
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 10L, 1F substantive — within ceiling |
| tier | ✓ | T1-agent / T1a-trivial (10L, 1F, single-area, fix) |
| stamphog 2.0.0b4 | .stamphog/policy.yml @ 127f1c0 · reviewed head 127f1c0 |
1 participant
Problem
Under enforcement, adding a payment method and the signup captcha would both fail.
script-srclists no third-party host, so two scripts the app loads itself violate our own policy. The policy is report-only, so both still run today.Over 24 hours, on documents carrying the current policy:
js.stripe.com, 90 reports across 52 documents, on/signup, the user-navigation settings page and the onboarding plans step.PaymentEntryModal.tsxcallsloadStripe, which injects the script.challenges.cloudflare.com, 14 reports across 7 documents, on/signup.signupLogic.tsdrives the Turnstile widget, which loads the API.The document counts are small because these are rare flows, not because the reports are noise. Each one is a person who reached checkout or a signup challenge.
Changes
script-srcgainshttps://js.stripe.comandhttps://challenges.cloudflare.com.script-srcneeds them.frame-src 'self' https:already admits the iframes each vendor opens, and neither reported aconnect-srcviolation across those 52 documents, which says their API calls happen inside those frames rather than from our page.How did you test this code?
script-src, and an assertion on the directive text would pin the exact string and fail on every later edit.TestCSPMiddlewareneeds Postgres, which this sandbox does not have. CI covers it.frontend/src/scenes/billing/PaymentEntryModal.tsxandfrontend/src/scenes/authentication/signup/signupForm/signupLogic.ts.Automatic notifications
Docs update
None.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
/writing-pr-descriptions,/writing-tests,/reviewing-with-coderabbit.