CORS error when using helper

[DmS]

Hi.
In a payment provider we are building we are getting a html-snippet back from the payment provider which we are to render in the checkout flow.
(We have no control over the htmlsnippet, but it basically places a div on the page, then runs a script that injects an iframe from their side)

If we simply echo it out from the payment-providers processOrder method to test it, it renders and we can interact with it as intended. But of course this is not the right way, since it breaks a lot of the built in functionality in the checkout flow.

So if we use this to pass it to the frontend in the expected way:

Code: Select all

return new \Aimeos\MShop\Common\Helper\Form\Standard( '', '', [], false, $html );

We get it rendered in the right place, BUT it triggers a CORS error since the script is not allowed to run.

But the script runs in all other scenarios except this, inside the site, in a separate test env, in postman...

I've set the config/cors.php to allow all paths and ran php artisan optimize to clear all conf caches, did not help.

Any suggestions on what might cause it in this particular case?
/Dan

[DmS]

Reason found.
The <meta http-equiv="Content-Security-Policy" ... tag needs another config to allow inline scripts from other sources to run