Skip to main content

ThreeDSCompletion

How a 3DS iframe reports that it is done.

Both the 3DS Method iframe and the challenge iframe are cross-origin: their content is unreadable from your page. The only way they can hand a result back is a postMessage to the parent window, sent by the page the flow finally lands on — the notification endpoint's response in the EMVCo browser flow, the PSP's collection endpoint for a device-data collection, or your own return page for a PSP that posts the result to a merchant URL.

origins is an allowlist of exact origins (scheme + host + port). A message from anywhere else is ignored. On top of that, the message must come from the iframe the helper created — so another frame, a popup, or a dev-tool posting on your own origin cannot end the flow with a forged result.

Properties​

match?​

optional match?: (data, event) => boolean;

Decides whether a message from an allowed origin is the completion. Receives the decoded payload — JSON and base64-encoded JSON are both decoded for you, anything else is handed over as the raw string.

Defaults to accepting the first message from an allowed origin.

Parameters​

ParameterType
dataunknown
eventMessageEvent

Returns​

boolean

Example​

match: (data) => (data as { MessageType?: string }).MessageType === 'profile.completed'

origins​

origins: string[];

Exact origins allowed to complete the flow, e.g. ['https://api.purse.tech']. Wildcards are not supported: an entry must match event.origin exactly.