a month ago
I need to disable the Content Security Policy (CSP) for my frontend service because it's blocking scripts from Mercado Pago's checkout domain, preventing payment processing from working.
Project: agent-builder Frontend service: nuro (https://nuro.up.railway.app)
The CSP is blocking inline scripts on Mercado Pago's checkout pages (secure-fields.mercadopago.com), causing this error:
Executing inline script violates the following Content Security Policy directive: 'script-src 'nonce-...' 'strict-dynamic' 'unsafe-eval' https: 'unsafe-inline' 'report-sample''
I've tried adding CSP headers via Nixpacks and meta tags, but Railway's infrastructure-level CSP is overriding them. Please disable or modify the CSP to allow Mercado Pago domains:
https://*.mercadopago.com
https://secure-fields.mercadopago.com
Thank you for your help.*
1 Replies
a month ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 1 month ago
a month ago
I tested the live Railway frontend and Railway is not injecting a CSP header on https://nuro.up.railway.app/, /account, or /plans. The visible CSP appears to come from Mercado Pago’s own secure-fields.mercadopago.com document, not Railway. A merchant-side CSP can allow loading Mercado Pago SDK/iframes, but it cannot disable or loosen CSP inside Mercado Pago’s iframe.
If your own app has a CSP elsewhere, add Mercado Pago to script-src, frame-src, and connect-src. If the console error source is secure-fields.mercadopago.com, the fix is likely using the official Mercado Pago SDK/Secure Fields flow correctly or opening an issue with Mercado Pago, not changing Railway infrastructure.
Suggested app-side CSP, if you have one
Content-Security-Policy:
default-src 'self';
script-src 'self' https://sdk.mercadopago.com https://www.mercadopago.com;
frame-src 'self' https://.mercadopago.com https://.mercadolibre.com;
connect-src 'self' https://api.mercadopago.com https://*.mercadopago.com;
img-src 'self' data: https:;
style-src 'self' 'unsafe-inline';