From 8e0500fe7abf70a71d1a47ba44159287946e7957 Mon Sep 17 00:00:00 2001
From: Kimmo Puputti <git@kimmo.kpuputti.fi>
Date: Fri, 9 Feb 2018 16:38:35 +0200
Subject: [PATCH] Whitelist Stripe API in the CSP

---
 server/csp.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/csp.js b/server/csp.js
index c99b201d..7d0e23f6 100644
--- a/server/csp.js
+++ b/server/csp.js
@@ -34,6 +34,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
   const googleFonts = 'https://fonts.googleapis.com/';
   const stripeJs = 'https://js.stripe.com/';
   const stripeQ = 'https://q.stripe.com/';
+  const stripeApi = 'https://api.stripe.com/';
   const sentryApi = 'https://sentry.io/api/';
 
   const scriptSrc = [self, inline, googleMaps, stripeJs];
@@ -52,7 +53,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
     googleStaticMaps,
   ];
 
-  const connectSrc = [self, sharetribeApi, googleMaps];
+  const connectSrc = [self, sharetribeApi, googleMaps, stripeApi];
 
   const fontSrc = [self, data, sharetribeAssets, googleStaticFonts];