A more meaningful error message than "the iframe has not configured" is needed

[dougmccluer]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
I'm never able to checkout on a site that uses Ayden for collecting credit card payments. The form fields always display the message, "the iframe has not configured" and "secured fields have failed to configure" appears in the console. I don't have any problem with other credit card payment platforms - just with Ayden.

Describe the solution you'd like
If Ayden requires a capability that is not present or enabled in the user's browser, the error message should say what the missing required feature is.

Ex. "WebGL is required", or "failed to load scripts from checkoutshopper-live-us.cdn.ayden.com", etc...

This would allow the user to address whatever is wrong.

Asking the user to completely disable their privacy & security extensions/software is not really a reasonable ask, because doing so exposes the user to everything, including potentially malicious scripts coming from other sources. But it may be reasonable to add Ayden and its dependencies to a whitelist that would allow them to run while still maintaining protection against other threats.

[m1aw]

Hey @dougmccluer

Thank you for the feedback.

Could you share with us a few details about your browser environment? What browser and version are you using? Do you have any specific addons/extensions enabled to enhance your privacy (like uBlock)?

Also can you reproduce this issue with your browser on mystoredemo.io?

[dougmccluer]

Could you share with us a few details about your browser environment? What browser and version are you using? Do you have any specific addons/extensions enabled to enhance your privacy (like uBlock)?

Also can you reproduce this issue with your browser on mystoredemo.io?

Yes, I can reproduce on mystoredemo.io in the latest Firefox, with uBlock, with rules allowing scripts from ayden.com subdomains.

[m1aw]

@dougmccluer I tried to reproduce on my Firefox 141 on MacOS 15.5 with uBlock Origin and mystoredemo.io works for me.

Can you share with if you have a specific "Enhance browser privacy" feature turned on?

Or any additional security feature?

[m1aw]

I have additionally tested this on Firefox with Strict mode enabled still cannot reproduce. I'm manually flagging as Stale if we don't hear back it will be closed. Feel free to open again if you have more info.

[dougmccluer]

I have additionally tested this on Firefox with Strict mode enabled still cannot reproduce. I'm manually flagging as Stale if we don't hear back it will be closed. Feel free to open again if you have more info.

@m1aw Yes, I have enhanced tracking protection on. I also have resistFingerprinting enabled.

I want to encourage you to not get distracted trying to reproduce every detail about my specific environment, because a hyper-targeted fix is likely to be brittle and limited in impact. Rather, can I suggest having the Ayden component check to see if all its dependencies are present, and communicate in the error message which ones are missing? That way, end users can make whatever adjustments are necessary to enable Ayden to function, even if the root cause of their specific issue is different from the one I am experiencing.

[m1aw]

@dougmccluer I have tried with resistFingerprinting enabled and it all loaded for me in mystoredemo.io. Then went the extra set to also try with NoScript extension and also worked (as long as "script" was enabled for that domain ofc).

While I agree with the your comment, we would love to provide this information, right now we would have to retroactive check were we call every web API and write proper failure handling code. This sounds "trivial" but not all web APIs have very clear cut way to be identified.

That's why I was asking for a reproducible step, so we could see how you go about setting these permissions, cater initially to your use case and expand from there into more generic use cases.

So if you can provide more details on your use case, how do you go about enabling and disabling each web API, and what information would be useful for you we are happy to dive into this. Hope your understand that without your collaboration on this there's not much of an incentive to pursue this issue.

[github-actions]

This issue is stale because it has been open 21 days with no activity. Please comment on this issue otherwise it will be closed in 7 days.

[github-actions]

This issue was closed because it has been stalled for 7 days with no activity.