Search code examples
iframepaypalcross-domainworldpay

Breaking out of an iframe with several limitations


We're using Worldpay as our payment provider and we're implementing PayPal as part of worldpay meaning we only integrate with Worldpay and they handle the PayPal integration.

This presents quite a few problems though.
We display the payment form in an iframe but PayPal doesn't allow to be framed.
They use the X-Frame-Origin header to block iframes.

Simple, just use javascript to detect paypal and break out!

We're not allowed to use javascript :(

Ok, what about target="_top"?

There are several payment options of which PayPal is the only one that cannot be iframed.

But just create two forms then?

This is where it becomes really retarded, Worldpay takes our form (the first form on the page to be specific), updates the target and some other attributes and wraps it around the entire page meaning there will be nested forms which aren't supported.

Besides, this means we'd have to manually created the second form which means that if worldpay ever changes things with the form they generate we'd break.

Is there any solutions to this?


Solution

  • Turns out that using WorldPay's horrible template language you can add multiple forms so there is no need to nest them.