psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

fix(csp): allow Stripe-hosted destinations in bunyip-web form-action (BUNYIP-235) #264

Merged
YousifShkara merged 1 commit from fix/BUNYIP-235-bunyip-web-csp-stripe-form-action into main 2026-06-29 07:00:22 +02:00
Conversation 0 Commits 1 Files changed 1 +26 -2
YousifShkara commented 2026-06-29 06:22:53 +02:00
Owner
Copy link

The membership Subscribe button posts to /membership/subscribe, which 302s to https://checkout.stripe.com/... to start a Checkout session. Per CSP3 the form-action directive applies to the entire request chain including the server-side redirect target, so bunyip-web's CSP form-action 'self' silently dropped every Subscribe click and the user saw the page just refresh.

bunyip-web has its OWN CSP at bunyip-web/src/security.rs (BUNYIP-232) - distinct from the dunite-core one that wraps bunyip-api responses. The earlier dunite-core fix on this ticket only addresses bunyip-api-served responses; this PR completes the fix for the bunyip-web pages the user actually loads. Same change pattern: extend form-action to 'self' https://checkout.stripe.com https://billing.stripe.com, mirroring the frame-src style of stripe-hosted-host allowlisting already used elsewhere in the security space.

New unit test pins the substring so a future tightening surfaces in CI before it ships and breaks every Subscribe button.

After deploy the cancel-then-subscribe flow works end-to-end: cancel trial, click Subscribe, lands on Stripe Checkout on first click.

#BUNYIP-235

The membership Subscribe button posts to /membership/subscribe, which 302s to https://checkout.stripe.com/... to start a Checkout session. Per CSP3 the form-action directive applies to the entire request chain including the server-side redirect target, so bunyip-web's CSP `form-action 'self'` silently dropped every Subscribe click and the user saw the page just refresh. bunyip-web has its OWN CSP at bunyip-web/src/security.rs (BUNYIP-232) - distinct from the dunite-core one that wraps bunyip-api responses. The earlier dunite-core fix on this ticket only addresses bunyip-api-served responses; this PR completes the fix for the bunyip-web pages the user actually loads. Same change pattern: extend form-action to `'self' https://checkout.stripe.com https://billing.stripe.com`, mirroring the frame-src style of stripe-hosted-host allowlisting already used elsewhere in the security space. New unit test pins the substring so a future tightening surfaces in CI before it ships and breaks every Subscribe button. After deploy the cancel-then-subscribe flow works end-to-end: cancel trial, click Subscribe, lands on Stripe Checkout on first click. #BUNYIP-235
fix(csp): allow Stripe-hosted destinations in bunyip-web form-action (BUNYIP-235)
All checks were successful
E2E / Playwright against deployment (pull_request) Successful in 35s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 24m52s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
a26fc8cb95 
The membership Subscribe button posts to /membership/subscribe, which 302s to https://checkout.stripe.com/... to start a Checkout session. Per CSP3 the form-action directive applies to the entire request chain including the server-side redirect target, so bunyip-web's CSP `form-action 'self'` silently dropped every Subscribe click and the user saw the page just refresh.

bunyip-web has its OWN CSP at bunyip-web/src/security.rs (BUNYIP-232) - distinct from the dunite-core one that wraps bunyip-api responses. The earlier dunite-core fix on this ticket only addresses bunyip-api-served responses; this PR completes the fix for the bunyip-web pages the user actually loads. Same change pattern: extend form-action to `'self' https://checkout.stripe.com https://billing.stripe.com`, mirroring the frame-src style of stripe-hosted-host allowlisting already used elsewhere in the security space.

New unit test pins the substring so a future tightening surfaces in CI before it ships and breaks every Subscribe button.

After deploy the cancel-then-subscribe flow works end-to-end: cancel trial, click Subscribe, lands on Stripe Checkout on first click.

#BUNYIP-235
YousifShkara deleted branch fix/BUNYIP-235-bunyip-web-csp-stripe-form-action 2026-06-29 07:00:22 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!264
No description provided.