URL: https://securepaymentform.starbucks.com/
Submission: On September 26 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 98.99.252.15, located in Ashburn, United States and belongs to STARBUCKS, US. The main domain is securepaymentform.starbucks.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on October 27th 2023. Valid for: a year.
This is the only time securepaymentform.starbucks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 98.99.252.15 62566 (STARBUCKS)
15 1
Apex Domain
Subdomains
Transfer
15 starbucks.com
securepaymentform.starbucks.com
596 KB
15 1
Domain Requested by
15 securepaymentform.starbucks.com securepaymentform.starbucks.com
15 1

This site contains no links.

Subject Issuer Validity Valid
securepaymentform.starbucks.com
Sectigo RSA Organization Validation Secure Server CA
2023-10-27 -
2024-10-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://securepaymentform.starbucks.com/
Frame ID: A0A3ED956C19A8FFC251238417A855BA
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

Credit or Debit Card Details

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

596 kB
Transfer

590 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
securepaymentform.starbucks.com/
1 KB
2 KB
Document
General
Full URL
https://securepaymentform.starbucks.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
9545e406887951c9a541d5500573138e3981af3c38890713e1844d39646ac786
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.starbucks.com *.starbucks.ca; frame-ancestors 'self' *.starbucks.com *.starbucks.ca; script-src 'self' *.starbucks.com *.starbucks.ca; style-src 'self' *.starbucks.com *.starbucks.ca; connect-src 'self' *.starbucks.com *.starbucks.ca; media-src 'self' *.starbucks.com *.starbucks.ca; object-src 'none'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Credentials
true
Cache-Control
public, max-age=0
Content-Length
1101
Content-Security-Policy
default-src 'self' *.starbucks.com *.starbucks.ca; frame-ancestors 'self' *.starbucks.com *.starbucks.ca; script-src 'self' *.starbucks.com *.starbucks.ca; style-src 'self' *.starbucks.com *.starbucks.ca; connect-src 'self' *.starbucks.com *.starbucks.ca; media-src 'self' *.starbucks.com *.starbucks.ca; object-src 'none'
Content-Type
text/html; charset=UTF-8
Date
Thu, 26 Sep 2024 18:36:21 GMT
ETag
W/"44d-190ff7d5be0"
Keep-Alive
timeout=5
Last-Modified
Mon, 29 Jul 2024 17:15:24 GMT
Vary
Origin
x-correlation-id
55246f2b-f3bf-42b6-b590-86eab5733b3e
main-Dq9F_1gd.js
securepaymentform.starbucks.com/assets/
326 KB
327 KB
Script
General
Full URL
https://securepaymentform.starbucks.com/assets/main-Dq9F_1gd.js
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
ca85678fb0c94f90384255eb8f6991ed0487852e4f4fc6d43d6ee6e10cc9f43e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
34fa8663-3d1c-4dda-8ba4-b3e81565b72a
ETag
W/"51974-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
334196
Date
Thu, 26 Sep 2024 18:36:21 GMT
Content-Type
application/javascript; charset=UTF-8
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
modulepreload-polyfill-B5Qt9EMX.js
securepaymentform.starbucks.com/assets/
771 B
1 KB
Script
General
Full URL
https://securepaymentform.starbucks.com/assets/modulepreload-polyfill-B5Qt9EMX.js
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
607112fb81d7899ceedf89cdb1b3540a53eb96ad5e4202fb1e22f873281de839

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
3d014a0c-49c3-4b52-827d-ebf577812dde
ETag
W/"303-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
771
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
application/javascript; charset=UTF-8
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
main-CzXrLRHr.css
securepaymentform.starbucks.com/assets/
136 KB
137 KB
Stylesheet
General
Full URL
https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
c7dd9e51d434aaf3c2120e9d43b97ecc1cc3f63fd6abe7dc27789c4c22666d70

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
010431f3-b58f-4ad2-813a-96561a6b718b
ETag
W/"2210d-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
139533
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
text/css; charset=UTF-8
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
client-config
securepaymentform.starbucks.com/
224 B
523 B
Fetch
General
Full URL
https://securepaymentform.starbucks.com/client-config
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/assets/main-Dq9F_1gd.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
4f0f5c0424ed6f048271099fab387e9b9497243e49eae425817d3cec32fd4796

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

x-correlation-id
ba3717f9-ca39-4e11-9709-6e8f6e0df863
ETag
W/"e0-WpLWcAAiaTI/gyzbiE3dd+Tpu5k"
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=5
Content-Length
224
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
application/json; charset=utf-8
Vary
Origin
en-US-q0JOEm18.js
securepaymentform.starbucks.com/assets/
2 KB
3 KB
Script
General
Full URL
https://securepaymentform.starbucks.com/assets/en-US-q0JOEm18.js
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/assets/main-Dq9F_1gd.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
27d08d2921ddffd2321f80b568939ce30efad78328a62426bd0223b12accad6e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/assets/main-Dq9F_1gd.js

Response headers

Cache-Control
public, max-age=0
x-correlation-id
6e97751d-74c7-4680-b617-eb9a88d5dfa8
ETag
W/"8a4-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2212
Date
Thu, 26 Sep 2024 18:36:21 GMT
Content-Type
application/javascript; charset=UTF-8
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
favicon-32x32.png
securepaymentform.starbucks.com/images/
3 KB
4 KB
Other
General
Full URL
https://securepaymentform.starbucks.com/images/favicon-32x32.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
a49e1471c81d1bef480b86a98ace62fcc6c7bef479ce649dd1bd6ab0d1e32955

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
dedc47ed-1f40-41e2-8e3b-e1553a2859e3
ETag
W/"dca-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
3530
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
image/png
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin
SoDoSans-Regular-DXL2B6i_.woff
securepaymentform.starbucks.com/assets/
36 KB
36 KB
Font
General
Full URL
https://securepaymentform.starbucks.com/assets/SoDoSans-Regular-DXL2B6i_.woff
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
3985c3a1e01219a0d0b35015ee6d55de1d22313935a155dfaa014fd3b9f2f85b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css

Response headers

Cache-Control
public, max-age=0
x-correlation-id
9a05f3df-f4a2-409a-898f-7e2790832269
ETag
W/"8ec4-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
36548
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
font/woff
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
SoDoSans-SemiBold-DGRftu2p.woff
securepaymentform.starbucks.com/assets/
37 KB
37 KB
Font
General
Full URL
https://securepaymentform.starbucks.com/assets/SoDoSans-SemiBold-DGRftu2p.woff
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
87221f4168a0c74bb086b412a20d814ace5a7d0c93c2a27c907fe1cdc15bd504

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css

Response headers

Cache-Control
public, max-age=0
x-correlation-id
bebff684-8906-4884-a266-7fc9f210c6cf
ETag
W/"9474-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
38004
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
font/woff
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
SoDoSans-Bold-CMoRS8y8.woff
securepaymentform.starbucks.com/assets/
37 KB
37 KB
Font
General
Full URL
https://securepaymentform.starbucks.com/assets/SoDoSans-Bold-CMoRS8y8.woff
Requested by
Host: securepaymentform.starbucks.com
URL: https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
5a3e3c8a98936e9d5e02c3f5c5bface86613291002e14bfc7490365a3ef6fdf8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://securepaymentform.starbucks.com
Referer
https://securepaymentform.starbucks.com/assets/main-CzXrLRHr.css

Response headers

Cache-Control
public, max-age=0
x-correlation-id
652e0180-aa87-4630-9b12-ad497a51e3a9
ETag
W/"93b0-190ff7d57f8"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
37808
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
font/woff
Last-Modified
Mon, 29 Jul 2024 17:15:23 GMT
Vary
Origin
visa.svg
securepaymentform.starbucks.com/images/
1 KB
2 KB
Image
General
Full URL
https://securepaymentform.starbucks.com/images/visa.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
744a195fa8d6c4b35361ef56dd66c77ba9bf2e0224ee81a781a69c67554b70ad

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
a6abde32-9ee4-440c-96e5-07f55ded7a26
ETag
W/"49a-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1178
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
image/svg+xml
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin
discover.svg
securepaymentform.starbucks.com/images/
3 KB
3 KB
Image
General
Full URL
https://securepaymentform.starbucks.com/images/discover.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
2f1e9bd480c012521202393a54bd32f16b1141d0bac4c913d4a60e55f3572a96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
05741452-5ea5-4d1e-84ed-409c93c74d14
ETag
W/"c47-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
3143
Date
Thu, 26 Sep 2024 18:36:21 GMT
Content-Type
image/svg+xml
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin
master-card.svg
securepaymentform.starbucks.com/images/
1 KB
2 KB
Image
General
Full URL
https://securepaymentform.starbucks.com/images/master-card.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
3b373533bc6a07fc7bc3d42401fb630fff7c8255981351e2d27a815463e6c92e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
3fa7b965-7917-44aa-908b-4cb8a0a4bd94
ETag
W/"57e-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1406
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
image/svg+xml
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin
amex.svg
securepaymentform.starbucks.com/images/
2 KB
3 KB
Image
General
Full URL
https://securepaymentform.starbucks.com/images/amex.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
ecbb655dea901551da8ade47ce51ff077cda78650bfe5d11325219213438cfdb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
91670e35-301e-48b6-afa6-db6bf740abee
ETag
W/"9d4-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2516
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
image/svg+xml
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin
favicon-16x16.png
securepaymentform.starbucks.com/images/
2 KB
2 KB
Other
General
Full URL
https://securepaymentform.starbucks.com/images/favicon-16x16.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
98.99.252.15 Ashburn, United States, ASN62566 (STARBUCKS, US),
Reverse DNS
Software
/
Resource Hash
0affd8ad237352b7072c0717cb3d827c90858e43343fb0d09b72767d2107530c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://securepaymentform.starbucks.com/

Response headers

Cache-Control
public, max-age=0
x-correlation-id
10976b52-d78f-4d0a-8ca2-1d89b66a846f
ETag
W/"6dd-190ff7d4470"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1757
Date
Thu, 26 Sep 2024 18:36:22 GMT
Content-Type
image/png
Last-Modified
Mon, 29 Jul 2024 17:15:18 GMT
Vary
Origin

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __REACT_INTL_CONTEXT__

0 Cookies

3 Console Messages

Source Level URL
Text
security error URL: https://securepaymentform.starbucks.com/assets/main-Dq9F_1gd.js(Line 67)
Message:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' *.starbucks.com *.starbucks.ca". Either the 'unsafe-inline' keyword, a hash ('sha256-nly7aw7aMbzOrRiXufCQb8Y/Ol/HACEzLEpcL8/NWnY='), or a nonce ('nonce-...') is required to enable inline execution.
recommendation verbose URL: https://securepaymentform.starbucks.com/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://securepaymentform.starbucks.com/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.starbucks.com *.starbucks.ca; frame-ancestors 'self' *.starbucks.com *.starbucks.ca; script-src 'self' *.starbucks.com *.starbucks.ca; style-src 'self' *.starbucks.com *.starbucks.ca; connect-src 'self' *.starbucks.com *.starbucks.ca; media-src 'self' *.starbucks.com *.starbucks.ca; object-src 'none'