ESEN

Security (CSP)

Protect your clients by ensuring your quotes can only be opened where you authorize them.

The Clickjacking Threat

If any webpage on the Internet could simply create an <iframe> pointing to your clients’ private quotes, an attacker could build a fake overlaid page (UI Redressing or Clickjacking) and trick a client into clicking a fake payment button that actually clicks the accept button inside your invisible quote.

Because of this, Cord Elements’ security is strict from day one.

Frame Ancestors and the Allowlist

Cord mitigates this vulnerability through native HTTP headers known as Content Security Policy (CSP). Specifically, we use the frame-ancestors directive.

For the Elements installation snippet to work on your corporate website, you must first register your origins in the dashboard.

  1. Go to Settings > Developers > Elements.
  2. Look for the Allowed Domains section.
  3. Add the domains separated by line breaks.

Valid examples

The domain system allows strict origins or the use of wildcards:

  • your-company.com (Authorizes only the root).
  • *.your-company.com (Authorizes the root and any subdomain, like app.your-company.com).
  • https://portal.your-company.com (Highly specific).

Warning: If the domains list is completely empty, Cord will operate in an “Open Mode”, meaning the iframe can be embedded anywhere. We recommend this mode only during the local testing stage (localhost) and requiring domains before going to production.

Origin Validation in Events

Security doesn’t stop at preventing who can see the iframe. When Cord Elements fires events outward (like cord:approved), the communication could be intercepted by another malicious tab.

The SDK automatically attaches the parentOrigin parameter (your page’s window.location.origin) to the iframe’s URL. Cord cross-references it against your domain Allowlist: if you have at least one domain registered and that parentOrigin matches one of them, the window.postMessage channel routes the communication only to that specific origin.

Important: if there’s NO match (or you haven’t configured an Allowlist yet), Cord does not drop the event — it dispatches it with postMessage’s * target, the SDK’s historical behavior, so older integrations or a third-party <iframe> embedded without embed.js don’t break. This means that, without an Allowlist configured, any window in the frame chain can read the events. Hardening to a specific origin is an improvement that only kicks in once you register your domains — it isn’t an automatic rejection of the unauthorized. Configure your Allowlist in production; don’t rely on an unlisted origin “failing silently,” because that isn’t how it behaves today.