Skip to content
ESEN

Security (CSP)

Protect your clients by ensuring your quotes can only be opened where you authorize them.

The Clickjacking Threat

If any webpage on the Internet could simply create an <iframe> pointing to your clients’ private quotes, an attacker could build a fake overlaid page (UI Redressing or Clickjacking) and trick a client into clicking a fake payment button that actually clicks the accept button inside your invisible quote.

Because of this, Cord Elements’ security is strict from day one.

Frame Ancestors and the Allowlist

Cord mitigates this vulnerability through native HTTP headers known as Content Security Policy (CSP). Specifically, we use the frame-ancestors directive.

For the Elements installation snippet to work on your corporate website, you must first register your origins in the dashboard.

  1. Go to Settings › Embeddable quote builder, in the Developers section of the index (it shows up with Developer mode on in Your account › Preferences).
  2. Look for the Authorized domains step.
  3. Add the domains separated by line breaks.

Valid examples

The domain system allows strict origins or the use of wildcards:

  • your-company.com (Authorizes only the root).
  • *.your-company.com (Authorizes the root and any subdomain, like app.your-company.com).
  • https://portal.your-company.com (Highly specific).

No domains: read-only

If the domain list is empty, any site can embed the quote, but only to display it. Approving, signing and paying are not offered inside the iframe: instead, a button opens the proposal in a new tab on Cord’s domain, where no third-party site can overlay anything. Events are sent without detail (no signer name, no payment URL).

With at least one domain registered, frame-ancestors restricts every ancestor of the iframe and the quote is interactive.

Events only reach your origin

The SDK appends the parentOrigin parameter (your page’s window.location.origin) to the iframe URL. If it matches your list, window.postMessage targets events only at that origin. Without a match, the iframe is still protected by frame-ancestors: only a page on your domains can be in the frame chain.

Payment never runs inside the iframe

The payment page can never be framed. When paying from an embed, Cord opens it in its own window and the cord:pay event carries its absolute URL. Card data never passes through a document that your site, or anyone else’s, could cover.

Keys

  • Publishable Key (pk_live_): only works once allowed domains are configured. Without them, the API responds origin_allowlist_required. pk_test_ keys work from any origin, including localhost.
  • Secret Key (sk_): never in a browser. If one arrives from a browser, the API responds secret_key_in_browser and you should revoke it: it is already exposed in the page source. @flouviahq/node also refuses to run in a browser.