---
updatedAt: 2025-11-11T01:48:14.000Z
agentTools:
  projectIndex: https://docs.pci-proxy.com/llms.txt
---

# Content Security Policy

As an additional layer of defense against cross-site scripting (XSS), clickjacking and other code injection attacks, it's recommended to put strict [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) directives in place.

This page describes which directives are required in order for the Secure fields solution to work correctly.

<Callout icon="💡" theme="default">
  ### This document assumes that the reader already has a restrictive Content Security Policy in place. Once a CSP header is being sent, all internal and external resources must be present.

  In order to avoid CSP violations, make sure to declare further script, style and frame sources depending on your project.
</Callout>

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Directive
      </th>

      <th>
        Production
      </th>

      <th>
        Sandbox
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        script-src
      </td>

      <td>
        pay.datatrans.com\
        pci-proxy.com
      </td>

      <td>
        pay.sandbox.datatrans.com\
        sandbox.pci-proxy.com
      </td>
    </tr>

    <tr>
      <td>
        style-src
      </td>

      <td>
        'unsafe-inline'
      </td>

      <td>
        'unsafe-inline'
      </td>
    </tr>

    <tr>
      <td>
        frame-src
      </td>

      <td>
        pay.datatrans.com\
        pci-proxy.com
      </td>

      <td>
        pay.sandbox.datatrans.com\
        sandbox.pci-proxy.com
      </td>
    </tr>
  </tbody>
</Table>

Example

```
Content-Security-Policy: default-src 'self'; script-src 'self' pay.datatrans.com pci-proxy.com; style-src 'self' 'unsafe-inline'; frame-src 'self' pay.datatrans.com pci-proxy.com
```