PCIv4 Implemenatation

PCI v4 Synopsis

PCI v4 goes into effect on March 31st 2025. This next major version of PCI adds numerous new controls to protect cardholder data from scripts included on the payment page.

Requirement 6.4.3

Requirement 11.6.1

Use Case: Import Maps

Import Maps provide a mechanism to control how the browser resolved module specifiers when importing JavaScript modules which has many benefits to anyone using modules in production

Example: Import Maps

        
        
<script type="importmap">
  {
    "imports": {
      "emailform": "https://cdn.dev/emailform@1.10.7",
      "shippingform": "https://cdn.dev/shippingform@1.10.7"
    }
  }
</script>
<script type="module">
  import emailform from "emailform";
  import shippingform from "shippingform";

  emailform.render("#contact");
  shippingform.render("#shipping");
</script>

Solution: Complete support of SRI in import maps

This feature is not yet supported in all major browsers and was introduced in June of 2024 so pending browser support strategy may not be feasible to use import maps with SRI by March 2025

Use Case: Dynamic Subresources

Potential Solution: Revive require-sri-for

require-sri-for is currently not active or supported but would allow enforcement of SRI prescense on script assets throughout the page lifecycle

Use Case: Third Party Evergreen SDKs

Payment Pages rely on Wallet or Pixel pages from third party vendors. Many of the most popular of which are evergreen versioned. This allows patches to be applied without coordination. This however will not play nice with SRI.

Potential Solutions: Third Party Evergreen SDKs

1. Sandbox in iFrames
2. Request vendors to versions assets and coordinate with consumers for updates
Represent architectural changes, inability to implement quick patches, and complex cordination

Open Questions

1. Will vendors rearchitect with static versions for SRI?
2. How can vendors coordinate release of SRI securely across consumers?
3. When will all major browsers support SRI in import maps?
4. Will require-sri-for be adopted before March 2025?

References

• CSP
• Subresource Integrity (SRI)
• Browser Support Import Maps
• Revive require-sri-for webspec
• Add subresource integrity support for ES modules, through importmaps