PIQ-4392: Update readme and remove hostedpages domain.

CHANGES.md

@@ -1,3 +1,7 @@
+### 1.3.1
+- Remove hostedpages domain support
+- Update readme
+
 #### 1.3.0
 - Add ClickToPay integration support
 - Provide high-level types with index.d.ts ([Issue 21](https://github.com/devcode-git/hosted-fields-sdk/issues/21))
@@ -59,7 +63,7 @@ the onLoadCallback never to be triggered.
 - Reset shouldn't be an action, it should only be a method that the parent-application can call
 
 #### 1.0.7
-- Added reset() as a method to HostedFields. Resets the targets to an empty array. Necessary to run before running a new setupContent to avoid duplicates.
+- Added reset() as a method to HostedFields. Resets the targets to an empty array. Necessary to run before running a new setupContent to avoid duplicates
 
 #### 1.0.6
 - Updated readme
@@ -78,7 +82,7 @@ the onLoadCallback never to be triggered.
 
 #### 1.0.1
 - Using 2.6.0 of uglify-js since earlier versions had a security-gap
-- Docs showing test-environment for hosted-fields.
+- Docs showing test-environment for hosted-fields
 
 #### 1.0.0
-- initial commit, basic features for generating fields.
+- initial commit, basic features for generating fields

README.md

@@ -5,9 +5,9 @@ Hosted fields SDK is a toolkit that allows you generate a form/set of fields. It
 > [!CAUTION]
 > **Migration and Deprecation Notice:** Starting from version 1.0.50, it is mandatory to use the `'https://card-fields.paymentiq.io/1.1.1/index.html'` as `hostedfieldsurl` value for **production** environments. Please update your configurations accordingly to avoid potential disruptions.
 >
-> The old hostedfieldsurl: `'https://hostedpages.paymentiq.io/1.0.51/index.html'` and well as *all versions previous to 1.0.50* **will be deprecated starting 15 March 2025**. Please note that using older versions and the old domain may expose your system to potential risks. Starting with version 1.1.1, **hostedpages** domain will not be used anymore.
+> The old hostedfieldsurl: `'https://hostedpages.paymentiq.io/1.0.51/index.html'` and well as *all versions previous to 1.0.50* **are deprecated**. Please note that using older versions and the old domain may expose your system to potential risks. Starting with version 1.1.1, **hostedpages** domain will not be used anymore.
 > 
-> This change is meant to enhance security and future compliance with the new requirements in the Payment Card Industry Data Security Standards. The old domain is scheduled for deprecation. We advise all users to transition to the new domain as soon as possible to maintain compliance and benefit from improved security measures.
+> This change is meant to enhance security and future compliance with the new requirements in the Payment Card Industry Data Security Standards. We advise all users to transition to the new domain as soon as possible to maintain compliance and benefit from improved security measures.
 > 
 > Obs. **The new domain supports versions starting with 1.0.50 and above.** Make sure your implementation is updated to at least this version to ensure compatibility.
 > 
@@ -185,8 +185,8 @@ For production environments use `'https://card-fields.paymentiq.io/1.1.1/index.h
 - 1.0.51
 - 1.0.50
 
-> [!WARNING]  
-> Please note that **previous versions**(older than 1.0.50), as well as old domain name ***hostedpages* will be deprecated and must be updated by 15 March 2025**.
+> [!NOTE]  
+> Versions older than 1.0.50 are no longer supported.
 
 
 **get**
@@ -468,12 +468,10 @@ If any errors are detected, an error message will be returned as the value of th
 
 ````
 
-### Migration Notice
+### Notes
 
-#### Domain Change Explanation and Disclaimer
-
-Overview of Change:
-We have recently updated the domain used for our card fields to enhance security and compliance with current standards. The old domain, while PCI DSS compliant, is scheduled for deprecation. We advise all users to transition to the new domain as soon as possible to maintain compliance and benefit from improved security measures.
+#### Minimum Supported Version
+Version 1.0.50 or later is required. Older versions are no longer supported.
 
 #### New Domain:
 Domain: `card-fields.paymentiq.io/1.1.1/`
@@ -490,7 +488,7 @@ Upgrade Your Version: Ensure your integration uses version 1.0.50 or later.
 Migrate to the New Domain: Begin using the new domain by updating your configurations accordingly.
 
 #### Deprecation Timeline:
-Old Domain: The old domain will be deprecated on 15 March, after which it will no longer be supported.
+Old Domain: The old domain is deprecated and no longer supported.
 
 #### Additional Notes:
 Reach out to our support team if you encounter any issues during the transition or require further assistance.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hosted-fields-sdk",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Hosted fields sdk",
   "main": "dist/index.js",
   "types": "index.d.ts",

src/sdk/api/index.js

@@ -41,8 +41,10 @@ var onClickToPayCheckoutErrorCallback;
 var autoFocusNext;
 // Keep track of number of loaded fields
 var onLoadCounter = 0;
+// Allowed postMessage origins
+var allowedOrigins = [];
 // This window.
-var window = document.parentWindow || document.defaultView;
+var window = document.parentWindow || document.defaultView;
 /**
  * ClickToPay attributes for the ClickToPay instance
  * @param locale default: "en_US"
@@ -56,6 +58,16 @@ var clickToPayConfig;
 const recommendedExpandedHeight = 850; // in px
 const iframeAllowPermissions = 'payment';
 
+function extractOrigin (url) {
+    try {
+        var anchor = document.createElement('a')
+        anchor.href = url
+        return anchor.protocol + '//' + anchor.host
+    } catch (error) {
+        return null
+    }
+}
+
 function setup (config) {
     merchantId = config.merchantId;
     renderMode = config.renderMode;
@@ -74,6 +86,12 @@ function setup (config) {
     el = config.el;
     clickToPayConfig = config.clickToPayConfig;
     clickToPayAttributes = config.clickToPayAttributes;
+    allowedOrigins = [];
+
+    var hostedFieldsOrigin = extractOrigin(hostedfieldsurl)
+    if (hostedFieldsOrigin) {
+        allowedOrigins.push(hostedFieldsOrigin)
+    }
 
     // Create a single iframe for all the fields (single) or create an iframe per field (multiple)
     if (renderMode && renderMode === 'single') {
@@ -86,12 +104,11 @@ function setup (config) {
 }
 
 function validateOrigin (origin) {
-    const validOrigins = [
-        origin,
+    const fallbackOrigins = [
         'https://test-hostedpages.paymentiq.io',
-        'https://hostedpages.paymentiq.io',
         'https://card-fields.paymentiq.io'
     ]
+    const validOrigins = [...allowedOrigins, ...fallbackOrigins]
     return validOrigins.indexOf(origin) > -1
 }