Security configuration

The API communicates with the embedded map over postMessage. To prevent messages from untrusted frames, it validates the origin of every inbound message. Enterprise embedders can tune this with a SecurityConfig.

The defaults (recommended)

By default the API runs in strict mode: it accepts messages only from the known Mapsted map origin and throws on any mismatch (loud-fail rather than silently discarding). You do not need to configure anything for the standard embed to be secure.

import { init } from '@mapsted/maps-js-api';

await init({ propertyId: 1643 }); // strict origin validation is on by default

Accepting a custom proxy origin

If you route the map through your own reverse proxy (so the iframe is served from your domain), the map's messages arrive from your origin, not maps.mapsted.com. Add that origin with additionalOrigins so validation still passes:

import { init, type SecurityConfig } from '@mapsted/maps-js-api';

const security: SecurityConfig = {
  strictMode: true,                                  // keep loud-fail on
  allowedOrigins: ['https://maps.mapsted.com'],      // required — no origins are trusted by default
  additionalOrigins: ['https://maps-proxy.example.com'],
};

await init({ propertyId: 1643, security });

• strictMode (boolean, default true) — when true, an unrecognized origin throws MAPSTED-1303 (ERR_SECURITY_CONFIG_ORIGIN_MISMATCH) so misconfiguration is caught immediately rather than producing a silently non-functional map.
• additionalOrigins (string[], optional) — extra origins to accept messages from, in addition to allowedOrigins. Use exact origins (https://host[:port]), never wildcards.

Keep strictMode: true in production. Turning it off makes origin mismatches non-fatal, which can mask an integration error. See SecurityConfig for the full type.