Interface: SecurityConfig

Configuration for postMessage origin validation.

Example

import { SecurityConfig, DEFAULT_SECURITY_CONFIG, validateOriginWithConfig } from '@mapsted/maps-js-api';

const config: SecurityConfig = {
  ...DEFAULT_SECURITY_CONFIG,
  allowedOrigins: ['https://maps.mapsted.com'],
  additionalOrigins: ['https://proxy.customer.com'],
  strictMode: true,
};

window.addEventListener('message', (event) => {
  if (!validateOriginWithConfig(event, config)) return;
  // ... handle message ...
});

Properties

Property	Modifier	Type	Description
additionalOrigins?	readonly	readonly string[]	Optional extra origins to accept in addition to allowedOrigins. Provided as a separate field so customers with custom proxy setups can extend the default whitelist without having to reconstruct allowedOrigins entirely. Example: add your proxy origin to additionalOrigins to accept messages from a custom reverse proxy.
allowedOrigins	readonly	readonly string[]	Whitelist of origins accepted for incoming postMessage events. Origins are matched by exact string equality (scheme + host + port). An empty array means "deny all" — every incoming message fails validation. Validation: if (!allowedOrigins.includes(event.origin)).
strictMode	readonly	boolean	When true, origin mismatches throw a MapstedError with code MAPSTED-1303 (ERR_SECURITY_CONFIG_ORIGIN_MISMATCH). When false, the mismatch is logged via console.warn and the message is silently discarded (validator returns false). 4.0.1 default is true (loud-fail over silent-discard), matching the behaviour of the legacy single-origin validateOrigin.