Magento checkout CSP problems with AJAX content (and inline JavaScript)
AJAX-injected checkout HTML with inline scripts can violate Content Security Policy even when the page is compliant. Return data or markup and initialise JavaScript from modules.
AJAX-injected checkout HTML with inline scripts can violate Content Security Policy even when the page is compliant. Return data or markup and initialise JavaScript from modules.
A checkout step loaded HTML via AJAX that included inline JavaScript, breaking CSP even though the parent page was compliant. We changed it to return markup and initialise the behaviour from an external module.
Why this matters now
CSP is a key control for PCI DSS 4.0 payment-page requirements. As enforcement gets stricter, inline scripts that used to work will be blocked.
RELATED GUIDEHow to stop spam and bot attacks on Adobe Commerce Cloud → Harden your Magento storeSecurity audits, patching and PCI-DSS 4.0 script controls.Get a free security audit →The safer pattern
- Return markup or JSON from AJAX endpoints — not <script> blocks
- Initialise behaviour with data-mage-init or x-magento-init
- Keep JavaScript in AMD modules
- Use nonces only where unavoidable
- Test with CSP in report-only mode first
Common mistakes to avoid
How we help with security
Frequently asked questions
What is report-only mode?
CSP reports violations without blocking, so you can find issues safely.
Does Hyvä avoid this?
Hyvä has its own CSP approach; custom code still needs care.
Can you fix our checkout CSP?
Yes — see Magento Security Hardening.