chromium/components/test/data/payments/csp/deny_csp_after_redirect.html

<!doctype html>
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=0.5, maximum-scale=0.5, minimum-scale=0.5">
    <!-- Allow connecting to test.example on any port, but deny connections to
         subdomains of test.example. -->
    <meta http-equiv="Content-Security-Policy" content="connect-src 'self' https://test.example:*">
    <script>
    async function checkCanMakePayment(paymentMethodName) {
      return new PaymentRequest(
            [{supportedMethods: paymentMethodName,}],
            {total: {label: 'Total', amount: {currency: 'USD', value: '0.01'}}})
        .canMakePayment();
    }
    </script>
  </head>
</html>