topic The target origin provided ('our domain') does not match the recipient window's origin ('auth.net do in Integration and Testing

The target origin provided ('our domain') does not match the recipient window's origin ('auth.net do

jfkrueger — Mon, 15 Feb 2021 21:43:39 GMT

We are having the same issue as in this post: https://community.developer.authorize.net/t5/Integration-and-Testing/AUthorize-net-hosted-payment-page-not-working-in-Chrome-Version/td-p/59271/highlight/false/page/2

From reading that post, we have tried applying the content-security-policy via web.config file (asp.net/IIS) is not working. We are passing a paymentProfileId in the token.

We are still seeing the error in the console.
- Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('our domain') does not match the recipient window's origin ('auth.net domain')
The payment gets cut off and is not the correct size so you cannot see all of the fields.
The purchase window does not close after a purchase.

Example of web.config:

We have even tried with the Content-Security-Policy-Report-Only but still no luck, it acts the same.

What can we do when the content-security-policy is not working?

Re: The target origin provided ('our domain') does not match the recipient window's origin ('auth.ne

NexusSoftware — Tue, 16 Feb 2021 11:42:54 GMT

Hello,

Try the following in your Web.config

<system.webServer>
  <httpProtocol>
<customHeaders>
<add name="Content-Security-Policy" value="frame-ancestors 'self' *.YOUR_WEBSITE.com *.authorize.net;" />
</customHeaders>
</httpProtocol>
</system.webServer>

Re: The target origin provided ('our domain') does not match the recipient window's origin ('auth.ne

jfkrueger — Tue, 23 Feb 2021 16:42:06 GMT

I'm pretty sure we've tried that but let me give it another go and post back, thank you for the suggestion!

Re: The target origin provided ('our domain') does not match the recipient window's origin ('auth.ne

jfkrueger — Fri, 26 Mar 2021 20:12:38 GMT

No dice, still does not work. I find it odd that it doesn't work with the report-only option. Does anyone know of a setting within IIS that would be overriding the web.config?

Re: The target origin provided ('our domain') does not match the recipient window's origin ('auth.ne

NexusSoftware — Fri, 26 Mar 2021 21:30:05 GMT

Sometimes this error is the result of a target window that has not finished loading.

The basic syntax to check that the target frame has loaded would be :

const iframe = document.getElementById("pay_frame");
iframe.addEventListener("load", function() {

// Continue to display the content ... 
});

For IIS, to disable inheritance in child applications, wrap the configuration block in a:

<location path="." inheritInChildApplications="false">

<system.webServer>
  <httpProtocol>
<customHeaders>
<add name="Content-Security-Policy" value="frame-ancestors 'self' *.YOUR_WEBSITE.com *.authorize.net;" />
</customHeaders>
</httpProtocol>
</system.webServer>

</location>