Security
How a distributor reviews the embed before it goes on a page: the two allowances the SDK's script asks a page's content security policy to carry, and the pin that binds the script to the exact bytes Yutai's build measured. The facts on this page come from that build, so the review works against the same script a distributor loads.
The policy
The SDK's script runs inside your page, so the page's content security policy has to allow two things: where the script loads from, and where the client the page connects reads the distributor API. The two allowances the SDK asks for:
script-src- The SDK's script loads from https://yutai.com, the origin of the script line the element pages show. Add that origin to the script-src line your policy already carries.
connect-src- The client your page made with
connectDistributorApireads Yutai's distributor API from https://api.yutai.com, the origin of the base the API reference's calls name. Pages that still connect the legacy address read the same calls from https://app.yutai.com. Add both origins to the connect-src line your policy already carries, so an address your page already connects never loses its calls.
Copy the two origins onto the lines your policy already carries, never instead of them:
script-src https://yutai.com;
connect-src https://api.yutai.com https://app.yutai.com;These are the only two allowances the SDK asks a page to carry: one script origin, and the two API origins on the connect-src line. The script carries its own styles inside itself, so nothing else in the policy needs to change for the embed to run.
The pin
A policy line names an origin, not a file: any script served at that origin would load. Yutai publishes the facts its build measured over the script's exact bytes, so a distributor pins the copy it loads instead of trusting the origin alone.
The script is served today.
The build that published the script is version 0.1.1. The tag below pins the copy the build measured: a script at the same address that differs by one character fails the tag instead of running.
<script src="https://yutai.com/sdk/v1/yutai-sdk-web.min.js" integrity="sha384-prV8+3pBqRnMjVmvERsipYn8qVCpPF0UokodU5EWP7tNhWAtxR2jJrWcBVkayjWn" crossorigin="anonymous"></script>The script registers the four embed elements, each with its own page: the credential card, the tier badge, the benefits list and the benefits module.