Security

The policy

The SDK's script runs inside your page, so the page's content security policy has to allow two things: where the script loads from, and where the client the page connects reads the distributor API. The two allowances the SDK asks for:

script-src

The SDK's script loads from https://app.yutai.com, the origin of the script line the element pages show. Add that origin to the script-src line your policy already carries.

connect-src

The client your page made with connectDistributorApi reads Yutai's distributor API from https://api.yutai.com, the origin of the base the API reference's calls name. Pages that still connect the legacy address read the same calls from https://app.yutai.com. Add both origins to the connect-src line your policy already carries, so an address your page already connects never loses its calls.

Copy the two origins onto the lines your policy already carries, never instead of them:

script-src https://app.yutai.com;
connect-src https://api.yutai.com https://app.yutai.com;

These are the only two allowances the SDK asks a page to carry: one script origin, and the two API origins on the connect-src line. The script carries its own styles inside itself, so nothing else in the policy needs to change for the embed to run.

A page on another origin reaches the distributor API through the browser, which sends a preflight first. That preflight allows only two request headers, Authorization and Content-Type, and the browser keeps its answer for an hour, so a repeated call does not ask again on every request. No cookie rides a call and the answer never allows credentials: the key is what the call carries. A page may read only three response headers from the answer, Retry-After, WWW-Authenticate and X-Request-Id; every other header stays unreadable to script, so a page that needs another one cannot see it.