Content Security Policy (CSP) 配置

如果你的网站设置了 Content Security Policy（CSP）响应头，需要放行以下指令，否则 Legend SDK 依赖的第三方资源会被浏览器拦截，表现为 KYC 流程卡住、支付组件加载失败或样式丢失。

CSP 指令

script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googleapis.com https://*.gstatic.com *.google.com https://*.ggpht.com *.googleusercontent.com blob:;
img-src 'self' https://*.googleapis.com https://*.gstatic.com *.google.com  *.googleusercontent.com data:;
frame-src *.google.com;
connect-src 'self' https://*.googleapis.com *.google.com https://*.gstatic.com  data: blob:;
font-src https://fonts.gstatic.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
worker-src blob:;

也可以用 <meta> 标签在页面内声明：

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-security-policy"
 content="script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googleapis.com https://*.gstatic.com *.google.com https://*.ggpht.com *.googleusercontent.com blob:;
img-src 'self' https://*.googleapis.com https://*.gstatic.com *.google.com  *.googleusercontent.com data:;
frame-src *.google.com;
connect-src 'self' https://*.googleapis.com *.google.com https://*.gstatic.com  data: blob:;
font-src https://fonts.gstatic.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
worker-src blob:;">
</head>

需要放行的第三方域名

SDK 内部使用了以下服务，按服务商分组：

Google（字体、地图、统计）

*.googleapis.com
*.gstatic.com
*.google.com
*.googleusercontent.com
*.googletagmanager.com
*.google-analytics.com
*.analytics.google.com
*.g.doubleclick.net
fonts.googleapis.com

Zendesk（在线客服）

static.zdassets.com
ekr.zdassets.com
ekr.zendesk.com
legendtrading.zendesk.com
*.zopim.com
v2assets.zopim.io
zendesk-eu.my.sentry.io

Veriff / Probity / Hotjar（身份核验与行为分析）

*.veriff.me
*.veriff.com
*.hotjar.com
*.probity.io

Checkout.com（信用卡支付与风控）

*.checkout.com
js.checkout.com
risk.checkout.com
fpjs.checkout.com
fpjscache.checkout.com
*.sandbox.checkout.com
risk.sandbox.checkout.com
fpjs.sandbox.checkout.com
fpjscache.sandbox.checkout.com

Worldpay / Cardinal Commerce（3-D Secure 验证）

*.worldpay.com
access.worldpay.com
try.access.worldpay.com
*.cardinalcommerce.com
centinelapi.cardinalcommerce.com
centinelapistag.cardinalcommerce.com

💡
带 sandbox 的域名只在沙箱环境用到。生产环境可以不放行，但保留也无妨——便于同一份配置在两套环境通用。

CSP 指令

需要放行的第三方域名

参考资料