I'm building a checkout page for a website and have a checkout page with a content security policy (CSP). When the customer pays with a card, they will see a box popup with the bank page that allows the bank to verify (if they want).
The problem I have is that the box that pops up is an iframe and I don't really want to allow all for frame-src in my CSP, I've currently allowed www.securesuite.co.uk but I'm guessing that's not the domain a German or French bank will use? Also I have a MasterCard but not a Visa or Maestro card and I don't have accounts for all the major banks they may all use different providers. My bank, Metrobank uses something like www.securesuite.co.uk/metrobank/ other banks do something similar according to Google.
Eventually, my CSP reporting page would gather them all but each one would mean a failed transaction for each failing frame source.
Do all banks use www.securesuite.co.uk? Does anybody else have a list of the domain names that are used by 3D secure across different banks and card types? We are based in UK/Europe and customers are spread across Europe and will use cards from all sorts of banks.