We’ve seen similar differences between sandbox and production with
hosted payment integrations. The fact that the same iframe works in
production but gets blocked in the sandbox makes it seem more like an
environment-side CSP change than an integrati...
I have seen similar CSP issues when browser security changes start
enforcing policies that were not causing problems before. I would first
compare the exact CSP error in Chrome and Edge and check whether the
required CyberSource domains are allowed b...
One thing I’d add is that security should be considered at both the
application and infrastructure level. Strong authentication and request
validation are important, but it’s also worth limiting unnecessary
exposed endpoints, keeping dependencies upd...
