paypal CSP guidelines incorrect/lacking

[pmcquay]

I am looking here: https://developer.paypal.com/docs/checkout/troubleshoot/support/#content-security-policy-rules at how to use a CSP header with the smart buttons integration. I fixed what I believe is a typo, where the docs say "xyz-123". I am also aware that I need to be generating this value, but I want to get it working as a proof of concept first.

CSP header: 

"Content-Security-Policy", "default-src 'self' 'nonce-xyz123'; script-src 'self' 'nonce-xyz123'; style-src 'self' 'nonce-xyz123'"

Script tag:

<script src="https://www.paypal.com/sdk/js?client-id=sb" data-csp-nonce="xyz123"></script>

The first problem I see is that nowhere in the docs do they say that data-csp-nonce is not the way to add a nonce to the script tag. It is for telling the script what the nonce is, so this thing is a non-starter, because the script is not allowed to run. I added nonce="xyz123" to the script tag, and it reduced the volume of errors.

This is where I am stuck. I have the below errors. Is there a more comprehensive guide for this/can anyone post a complete working example?

js?client-id=sb:1 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-xyz123'". Either the 'unsafe-inline' keyword, a hash ('sha256-gFw/6dJE+wu40FoS2cP4Jf0lc+fsCmMhwrvPgFZOeUI='), or a nonce ('nonce-...') is required to enable inline execution.

Vn @ js?client-id=sb:1
(anonymous) @ js?client-id=sb:1
i @ js?client-id=sb:1
e.dispatch @ js?client-id=sb:1
e.then @ js?client-id=sb:1
e.renderContainer @ js?client-id=sb:1
(anonymous) @ js?client-id=sb:1
i @ js?client-id=sb:1
e.dispatch @ js?client-id=sb:1
e.then @ js?client-id=sb:1
(anonymous) @ js?client-id=sb:1
n.try @ js?client-id=sb:1
e.render @ js?client-id=sb:1
(anonymous) @ js?client-id=sb:1
n.try @ js?client-id=sb:1
r @ js?client-id=sb:1
render @ js?client-id=sb:1
$.fn.adminAccountBalancePanel @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:15398
(anonymous) @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:15885
fire @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:3291
fireWith @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:3421
done @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:9533
(anonymous) @ packed.js?hash=8eeea10a3370a512f2f885441c81324c:9785
6Refused to load the image '' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data&colon;image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjQiIGhlaWdodD0iMzIiIHZpZXdCb3g9IjAgMCAyNCAzMiIgeG1sbnM9Imh0dHA6JiN4MkY7JiN4MkY7d3d3LnczLm9yZyYjeDJGOzIwMDAmI3gyRjtzdmciIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaW5ZTWluIG1lZXQiPjxwYXRoIGZpbGw9IiMwMDljZGUiIGQ9Ik0gMjAuOTA1IDkuNSBDIDIxLjE4NSA3LjQgMjAuOTA1IDYgMTkuNzgyIDQuNyBDIDE4LjU2NCAzLjMgMTYuNDExIDIuNiAxMy42OTcgMi42IEwgNS43MzkgMi42IEMgNS4yNzEgMi42IDQuNzEgMy4xIDQuNjE1IDMuNiBMIDEuMzM5IDI1LjggQyAxLjMzOSAyNi4yIDEuNjIgMjYuNyAyLjA4OCAyNi43IEwgNi45NTYgMjYuNyBMIDYuNjc1IDI4LjkgQyA2L...BDIDE3LjQ0MiA4LjYgMTguMTg5IDguNyAxOC43NTMgOC44IEMgMTguOTM5IDguOCAxOS4xMjcgOC44IDE5LjMxNCA4LjkgQyAxOS41MDEgOSAxOS42ODggOSAxOS43ODIgOS4xIEMgMTkuODc1IDkuMSAxOS45NjggOS4xIDIwLjA2MyA5LjEgQyAyMC4zNDMgOS4yIDIwLjYyNCA5LjQgMjAuOTA1IDkuNSBDIDIxLjE4NSA3LjQgMjAuOTA1IDYgMTkuNzgyIDQuNiBDIDE4LjY1OCAzLjIgMTYuNTA2IDIuNiAxMy43OSAyLjYgTCA1LjczOSAyLjYgQyA1LjI3MSAyLjYgNC43MSAzIDQuNjE1IDMuNiBMIDEuMzM5IDI1LjggQyAxLjMzOSAyNi4yIDEuNjIgMjYuNyAyLjA4OCAyNi43IEwgNi45NTYgMjYuNyBMIDguMjY3IDE4LjQgTCA5LjQ4NSA5LjUgWiI+PC9wYXRoPjwvc3ZnPg==' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data[Removed. Phone #s not permitted]PSIwIDAgMTAwIDMyIiB4bWxucz0iaHR0cDomI3gyRjsmI3gyRjt3d3cudzMub3JnJiN4MkY7MjAwMCYjeDJGO3N2ZyIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pbllNaW4gbWVldCI+PHBhdGggZmlsbD0iIzAwMzA4NyIgZD0iTSAxMiA0LjkxNyBMIDQuMiA0LjkxNyBDIDMuNyA0LjkxNyAzLjIgNS4zMTcgMy4xIDUuODE3IEwgMCAyNS44MTcgQyAtMC4xIDI2LjIxNyAwLjIgMjYuNTE3IDAuNiAyNi41MTcgTCA0LjMgMjYuNTE3IEMgNC44IDI2LjUxNyA1LjMgMjYuMTE3IDUuNCAyNS42MTcgTCA2LjIgMjAuMjE3IEMgNi4zIDE5LjcxNyA2LjcgMTkuMzE3IDcuMyAxOS4zMTcgT...MxNyBDIDc4LjUgMTcuMjE3IDgwLjMgMTUuNzE3IDgyLjQgMTUuNzE3IEMgODMuNSAxNS43MTcgODQuMyAxNi4xMTcgODQuOSAxNi43MTcgQyA4NS41IDE3LjQxNyA4NS43IDE4LjMxNyA4NS41IDE5LjMxNyBaIj48L3BhdGg+PHBhdGggZmlsbD0iIzAwOWNkZSIgZD0iTSA5NS4xIDUuNDE3IEwgOTEuOSAyNS43MTcgQyA5MS44IDI2LjExNyA5Mi4xIDI2LjQxNyA5Mi41IDI2LjQxNyBMIDk1LjcgMjYuNDE3IEMgOTYuMiAyNi40MTcgOTYuNyAyNi4wMTcgOTYuOCAyNS41MTcgTCAxMDAgNS42MTcgQyAxMDAuMSA1LjIxNyA5OS44IDQuOTE3IDk5LjQgNC45MTcgTCA5NS44IDQuOTE3IEMgOTUuNCA0LjkxNyA5NS4yIDUuMTE3IDk1LjEgNS40MTcgWiI+PC9wYXRoPjwvc3ZnPg==' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data&colon;image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDAiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCA0MCAyNCIgcHJlc2VydmV[Removed. Phone #s not permitted]MkY7d3d3LnczLm9yZyYjeDJGOzIwMDAmI3gyRjtzdmciPjxwYXRoIGQ9Ik0wIDEuOTI3QzAgLjg2My44OTIgMCAxLjk5MiAwaDM2LjAxNkMzOS4xMDggMCA0MCAuODYzIDQwIDEuOTI3djIwLjE0NkM0MCAyMy4xMzcgMzkuMTA4IDI0IDM4LjAwOCAyNEgxLjk5MkMuODkyIDI0IDAgMjMuMTM3IDAgMjIuMDczVjEuOTI3eiIgZmlsbD0icmdiKDMzLCA4NiwgMTU0KSI+PC9wYXRoPjxwYXRoIGQ9Ik0xOS41OTYgNy44ODVsLTIuMTEgOS40NzhIMTQuOTNsMi4xM...IuMTI1IDIuMjM0IDIuNTguOTk2LjQ2NCAxLjMzLjc2MiAxLjMyNSAxLjE3Ny0uMDA2LjYzNi0uNzkzLjkxOC0xLjUyNi45MjgtMS4yODUuMDItMi4wMy0uMzMzLTIuNjIzLS42bC0uNDYyIDIuMDhjLjU5OC4yNjIgMS43LjQ5IDIuODQuNTAyIDIuNjgyIDAgNC40MzctMS4yNzMgNC40NDUtMy4yNDN6TTE1Ljk0OCA3Ljg4NGwtNC4xMzggOS40NzhoLTIuN0w3LjA3NiA5LjhjLS4xMjMtLjQ2Ni0uMjMtLjYzNy0uNjA2LS44MzQtLjYxNS0uMzItMS42My0uNjItMi41Mi0uODA2bC4wNi0uMjc1aDQuMzQ1Yy41NTQgMCAxLjA1Mi4zNTQgMS4xNzguOTY2bDEuMDc2IDUuNDg2IDIuNjU1LTYuNDVoMi42ODN6IiBmaWxsPSJyZ2IoMjU1LCAyNTUsIDI1NSkiPjwvcGF0aD48L3N2Zz4=' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data&colon;image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDAiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCA0MCAyNCIgcHJlc2VydmV[Removed. Phone #s not permitted]MkY7d3d3LnczLm9yZyYjeDJGOzIwMDAmI3gyRjtzdmciPjxwYXRoIGQ9Ik0wIDEuOTI3QzAgLjg2My44OTIgMCAxLjk5MiAwaDM2LjAxNkMzOS4xMDggMCA0MCAuODYzIDQwIDEuOTI3djIwLjE0NkM0MCAyMy4xMzcgMzkuMTA4IDI0IDM4LjAwOCAyNEgxLjk5MkMuODkyIDI0IDAgMjMuMTM3IDAgMjIuMDczVjEuOTI3eiIgZmlsbD0icmdiKDYyLCA1NywgNTcpIj48L3BhdGg+PHBhdGggZmlsbD0icmdiKDI1NSwgOTUsIDApIiBkPSJNIDIyLjIwNSAzLjkwM...UgMTkuMTMgNy44MiAxOS44NSA3LjgyIDIwLjg0MSBDIDcuODIgMjEuODM3IDguNTQ1IDIyLjU1NCA5LjQ3NyAyMi41NTQgQyA5Ljk2IDIyLjU1NCAxMC4zMDQgMjIuMzgzIDEwLjUxMiAyMi4wNzYgTCAxMC41MTIgMjIuNDg2IEwgMTEuMjM2IDIyLjQ4NiBMIDExLjIzNiAyMC44NDEgWiBNIDguNTQ2IDIwLjg0IEMgOC41NDYgMjAuMjYxIDguOTI2IDE5Ljc4IDkuNTQ4IDE5Ljc4IEMgMTAuMTM0IDE5Ljc4IDEwLjU1IDIwLjIyNiAxMC41NSAyMC44NDEgQyAxMC41NSAyMS40MjYgMTAuMTM0IDIxLjkwNCA5LjU0OCAyMS45MDQgQyA4LjkyNiAyMS44NyA4LjU0NiAyMS40MjYgOC41NDYgMjAuODQzIFoiIGZpbGw9InJnYigyNTUsIDI1NSwgMjU1KSI+PC9wYXRoPjwvc3ZnPg==' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data&colon;image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDAiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCA0MCAyNCIgcHJlc2VydmV[Removed. Phone #s not permitted]MkY7d3d3LnczLm9yZyYjeDJGOzIwMDAmI3gyRjtzdmciPjxwYXRoIGQ9Ik0zOC4zMzMgMjRIMS42NjdDLjc1IDI0IDAgMjMuMjggMCAyMi40VjEuNkMwIC43Mi43NSAwIDEuNjY3IDBoMzYuNjY2QzM5LjI1IDAgNDAgLjcyIDQwIDEuNnYyMC44YzAgLjg4LS43NSAxLjYtMS42NjcgMS42eiIgZmlsbD0icmdiKDIwLCAxMTksIDE5MCkiPjwvcGF0aD48cGF0aCBkPSJNNi4yNiAxMi4zMmgyLjMxM0w3LjQxNSA5LjY2TTI3LjM1MyA5Ljk3N2gtMy43Mzh2MS4yM...EuMzI3LTEuNDgzIDEuMzI4IDEuNDgzaDUuNjA1bC00LjM2LTQuNjY3TDM4LjI1IDd6bS0xNy42ODUgOC4xaC0xLjU1N1Y5Ljg4M0wxNi42NzMgMTUuMWgtMS4zM0wxMy4wMSA5Ljg4M2wtLjA4NCA1LjIxN0g5LjczbC0uNjIzLTEuNTU2aC0zLjI3TDUuMTMyIDE1LjFIMy40MmwyLjg4NC02Ljc3MmgyLjQybDIuNjQ1IDYuMjMzVjguMzNoMi42NDZsMi4xMDcgNC41MSAxLjg2OC00LjUxaDIuNTc1VjE1LjF6bTE0LjcyNyAwaC0yLjAyNGwtMi4wMjQtMi4yNi0yLjAyMyAyLjI2SDIyLjA2VjguMzI4SDI5LjUzbDEuNzk1IDIuMTc3IDIuMDI0LTIuMTc3aDIuMDI1TDMyLjI2IDExLjc1bDMuMDMyIDMuMzV6IiBmaWxsPSJyZ2IoMjU1LCAyNTUsIDI1NSkiPjwvcGF0aD48L3N2Zz4=' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

about:blank:1 Refused to load the image 'data&colon;image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDAiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCA0MCAyNCIgcHJlc2VydmV[Removed. Phone #s not permitted]MkY7d3d3LnczLm9yZyYjeDJGOzIwMDAmI3gyRjtzdmciPjxkZWZzPjxwYXR0ZXJuIGlkPSJwYXR0ZXJuLTAiIHg9IjAiIHk9IjAiIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgcGF0dGVyblVuaXRzPSJ1c2VyU3BhY2VPblVzZSIgdmlld0JveD0iMCAwIDEwMCAxMDAiPjxwYXRoIGQ9Ik0gMCAwIEwgNTAgMCBMIDUwIDEwMCBMIDAgMTAwIFoiIHN0eWxlPSJmaWxsOiBibGFjazsiPjwvcGF0aD48L3BhdHRlcm4+PC9kZWZzPjxwYXRoIGQ9Ik0zOC4zMzMgMjRIM...IsOC4xIC0xOC4yLDE4LjIgbCAwLDIzLjggYyA0LjYsLTMuOSAxMi42LC02LjQgMjUuNSwtNS44IDYuOSwwLjMgMTQuMywyLjIgMTQuMywyLjIgbCAwLDcuNyBjIC0zLjcsLTEuOSAtOC4xLC0zLjYgLTEzLjgsLTQgLTkuOCwtMC43IC0xNS43LDQuMSAtMTUuNywxMi41IDAsOC41IDUuOSwxMy4zIDE1LjcsMTIuNSA1LjcsLTAuNCAxMC4xLC0yLjIgMTMuOCwtNCBsIDAsNy43IGMgMCwwIC03LjMsMS45IC0xNC4zLDIuMiAtMTIuOSwwLjYgLTIwLjksLTEuOSAtMjUuNSwtNS44IGwgMCw0MiAyNi43LDAgYyAxMCwwIDE4LjIsLTguMSAxOC4yLC0xOC4yIGwgMCwtOTEgLTI2LjcsMCB6IiBjbGFzcz0ic3Q1Ij48L3BhdGg+PC9nPjxnIGlkPSJnNjM4NiI+PC9nPjwvZz48L3N2Zz4=' because it violates the following Content Security Policy directive: "default-src 'self' 'nonce-xyz123'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

test.lvh.me/:1 Refused to frame 'https://www.sandbox.paypal.com/' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

[AdvertiseMeLtd]

I find the same problem, it looks like the sdk do not, or fail, to apply the nonce to the <style> tag created for the buttons.