Risk Management Javascript web SDK
This section describes how to embed the Gemalto Assurance Hub (GAH) signal collection scripts into you web application. In other words, it focuses on steps 1 and 2 of the evaluation use case.
Use cases
You can use GAH to analyze and provide decision recommendation for several use cases inside your website, such as login and account creation.
During a web session (between user login and logout), your customer can browse through different use cases on which you want to perform a getDecision.
View
A use case, such as login, is usually composed of a single view, which is a screen where the user enters their username and password, then clicks a login button.
Sometimes, a use case can include several views, such as the first view where the user enters their username and clicks a Next button, then a second view, where the user enters their password and clicks Login.
Signal collection
GAH, as well as the partners involved, have been tested on the last two major versions of Internet Explorer, Google Chrome, and Firefox.
The next section describes how CORS is used by the Gemalto Assurance Hub to enable your cross-origin HTTP requests made during signal collection.
CORS
Adding the GAH scripts into your web pages sends a Cross-Origin Resource Sharing (CORS) HTTP request to the GAH signal-collector domain. For security reasons, browsers block cross-origin requests initiated from within scripts.
As a result, the POST and PATCH signals request sent to GAH are blocked. To enable this cross-origin request, GAH supports the CORS protocol:
-
Before the POST or PATCH signals request is made, the browser first sends an HTTP request (OPTIONS) to the GAH domain.
-
The GAH back end processes this request and checks that it originates from an authorized domain (by looking at the origin HTTP header), for example: www.your-domain.com. Altogether, this means that every domain issuing POST or PATCH signals requests to the GAH must be declared in the product.
If you are implementing a risk assessment on your login page, and this page is delegated to an identity provider, the domain name of the server hosting the identity provider must be provisioned in GAH.
