Square Web Payments SDK – CSP inside Single Card Element iframe is blocking Square’s own font

Questions
, , ,
1

Hello, I’m encountering a Content Security Policy issue with the Square Web Payments SDK (Single Card Element). The CSP violation is occurring inside Square’s iframe, not on my server, and appears to be caused by an outdated CSP shipped within the iframe itself.

Here is the exact DevTools error:

Code

single-card-element-iframe.html:1 
Loading the font 'https://cash-f.squarecdn.com/static/fonts/cashsans/woff2/CashSans-Regular.woff2' 
violates the following Content Security Policy directive: 
"font-src https://square-fonts-production-f.squarecdn.com 
          https://d1g145x70srn7h.cloudfront.net/fonts/sqmarket/ 
          'report-sample'". 
The action has been blocked.

Important details:

  1. My checkout page does not send any Content-Security-Policy header.
    I verified this by checking the response headers directly.

  2. The CSP shown in the error does not match anything in my server configuration.
    It is coming from inside the Square iframe.

  3. Square’s July 2026 update moved CashSans fonts to:
    https://cash-f.squarecdn.com

  4. However, the CSP inside the iframe still only allows:

    • square-fonts-production-f.squarecdn.com

    • d1g145x70srn7h.cloudfront.net/fonts/sqmarket/

    • 'report-sample'

  5. Because of this mismatch, the iframe blocks Square’s own font request.

Summary of the issue:

Square’s iframe is enforcing a CSP that does not include the new font domain (cash-f.squarecdn.com). As a result, the Single Card Element attempts to load CashSans-Regular.woff2 but is blocked by the iframe’s internal CSP.

My server’s CSP is not involved — the checkout page sends no CSP header, and the error is entirely inside the Square iframe.

Expected behavior:

The iframe’s CSP should include:

Code

https://cash-f.squarecdn.com

so that the CashSans font can load correctly.

Request:

Can Square update the CSP inside the Single Card Element iframe to include the new font domain? This appears to be a Square-side issue introduced after the July 2026 CDN update.

Thank you — I can provide additional logs or details if needed.

3

@SquareYankee Thanks for the flag - confirming that this appears to be a bug and our team is looking at it right now! I will follow up when we have resolved it.

5

@SquareYankee Thanks for your patience - this should be resolved now!