Allow Klarna payments

If all are for example klarna.com-domains you can use this in your frame setting:

https://klarna.com
https://*.klarna.com

Does that answer your question?

Hi, thats the problem, all domains are not using klarna.com. It depends on what card you use. And if that card needs verification with BankID, a whole batch of urls are being called. Any ideas?

I would ask Klarna for a list of URLs.

Hi @markushasselryd,
I’m one of the authors of the Klarna Checkout and Klarna Payments plugins for WooCommerce.

I agree with @jonkastonka that it’s probably best to check directly with Klarna regarding this. At the same time I think your conclusion is spot on – it will be very difficult to limit specific domains since different card issuers communicate with different banks/3ds providers.

I’ve written to Klarna now, and if I get an answer I will post it here. But for now this is as far as we get with this. So I will set this as resolved.

Unfortunately Klarna is totally unwilling to help with this. I’ve sent them some information about what Content Security Policy is and what the consequences could be for their part by not supporting the technology.

https://darknetdiaries.com/episode/52/
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

That got them going.

“Ok, i will try to contact the right department and see if we can come up with a satisfying answer for you. Could you formulate the problem as specific as possible to make the quest easier?”

Ok, thank you for following this up!

@markushasselryd

This is what I got from Klarna:
frame-src *.klarna.com
script-src *.klarnacdn.net *.klarnaservices.com
img-src *.klarnaevt.com *.klarnacdn.net *.klarna.com

Does that help?

Did you try it @markushasselryd? Did it work?

Hi, sorry for not getting back to you, been overwhelmed with work. Have not tried these settings but it looks like it can’t be all of them. When I tested this the first time I had to allow several bank url’s, for example https://*.swedbank.se, https://*.nordea.se etc. As @niklashogefjord stated above, different card issuers communicate with different banks and when using BankID for direct payment, klarna communicates with other third party services as well. Seems pretty hard to nail every one of them without comprehensive testing?

• This reply was modified 4 years ago by markushasselryd.

Defenetly, I’ll contact them again.