# Square Web Payments SDK – CSP inside Single Card Element iframe is blocking Square’s own font

**URL:** <https://developer.squareup.com/forums/t/square-web-payments-sdk-csp-inside-single-card-element-iframe-is-blocking-square-s-own-font/27527>\
**Category:** Questions\
**Tags:** payments-api, payment-form, sdk, web-payments-sdk\
**Created:** [September 8, 2026, 5:06pm UTC](https://developer.squareup.com/forums/t/square-web-payments-sdk-csp-inside-single-card-element-iframe-is-blocking-square-s-own-font/27527 "2026-09-08T17:06:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SquareYankee](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@SquareYankee](https://developer.squareup.com/forums/u/SquareYankee)\
**Post date:** [September 8, 2026, 5:06pm UTC](https://developer.squareup.com/forums/t/square-web-payments-sdk-csp-inside-single-card-element-iframe-is-blocking-square-s-own-font/27527/1 "2026-09-08T17:06:49Z")

</div>

Hello, I’m encountering a Content Security Policy issue with the Square Web Payments SDK (Single Card Element). The CSP violation is occurring **inside Square’s iframe** , not on my server, and appears to be caused by an outdated CSP shipped within the iframe itself.

Here is the exact DevTools error:

Code

```auto
single-card-element-iframe.html:1 
Loading the font 'https://cash-f.squarecdn.com/static/fonts/cashsans/woff2/CashSans-Regular.woff2' 
violates the following Content Security Policy directive: 
"font-src https://square-fonts-production-f.squarecdn.com 
          https://d1g145x70srn7h.cloudfront.net/fonts/sqmarket/ 
          'report-sample'". 
The action has been blocked.

```

### **Important details:**

1. My checkout page does **not** send any Content-Security-Policy header.  
I verified this by checking the response headers directly.

2. The CSP shown in the error does **not** match anything in my server configuration.  
It is coming from **inside the Square iframe**.

3. Square’s July 2026 update moved CashSans fonts to:  
`https://cash-f.squarecdn.com`

4. However, the CSP _inside the iframe_ still only allows:

5. Because of this mismatch, the iframe blocks Square’s own font request.

### **Summary of the issue:**

Square’s iframe is enforcing a CSP that does not include the new font domain (`cash-f.squarecdn.com`). As a result, the Single Card Element attempts to load CashSans-Regular.woff2 but is blocked by the iframe’s internal CSP.

My server’s CSP is not involved — the checkout page sends no CSP header, and the error is entirely inside the Square iframe.

### **Expected behavior:**

The iframe’s CSP should include:

Code

```auto
https://cash-f.squarecdn.com

```

so that the CashSans font can load correctly.

### **Request:**

Can Square update the CSP inside the Single Card Element iframe to include the new font domain? This appears to be a Square-side issue introduced after the July 2026 CDN update.

Thank you — I can provide additional logs or details if needed.

---

<div class="post-metadata">

**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\
**Post date:** [September 8, 2026, 6:37pm UTC](https://developer.squareup.com/forums/t/square-web-payments-sdk-csp-inside-single-card-element-iframe-is-blocking-square-s-own-font/27527/3 "2026-09-08T18:37:26Z")

</div>

@SquareYankee Thanks for the flag - confirming that this appears to be a bug and our team is looking at it right now! I will follow up when we have resolved it.

---

<div class="post-metadata">

**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\
**Post date:** [September 10, 2026, 3:33pm UTC](https://developer.squareup.com/forums/t/square-web-payments-sdk-csp-inside-single-card-element-iframe-is-blocking-square-s-own-font/27527/5 "2026-09-10T15:33:03Z")

</div>

@SquareYankee Thanks for your patience - this should be resolved now!