Content Security Policy (CSP) is an advanced security feature that acts like a “whitelist” for a web page, controlling which external scripts, styles, fonts, and other resources are allowed to load. You set (in the Foxy admin, under settings → checkout) which domains scripts can load from, and the browser will prevent anything outside the policy from loading.
Not doing a custom checkout? If you don't have any customizations to your checkout (via templates or other configuration options to include custom javascript), you can likely just enable the CSP. We still recommend following the steps below, though, and testing first.
Though Foxy has strict security controls, we do allow for flexibility on our checkout templates. This allows our users to include their own custom scripts (which need to be allow-listed in the CSP).
As an example, let's say you want to include some tracking functionality on your checkout, via a script hosted at js.example.com, which sends data to tracking.example.com. You add those domains to your CSP and the browser allows the scripts to load and execute. If example.com is hacked, however, and the attacker wants to exfiltrate data to hacker.evil.tld, the CSP will prevent the browser from sending that data.
A CSP doesn't prevent the hack, but it can mitigate the impact. Further, a CSP can be helpful in ensuring PCI compliance.
What it does: Logs policy violations without blocking anything. This lets you review your policy first, ensuring you've added the necessary domains.
How to set it up:
example.com, *.example.com).What to monitor:
Once you've tested and confirmed your report-only CSP doesn't trigger alerts, you can copy the settings over to the non-report-only CSP.
Critical Checks After Enforcing:
Contact Foxy if you run into any issues.
Broken checkout after enabling CSP: Check your reporting endpoint for blocked domains, then add them to “Custom script sources” in the Foxy admin.