Mock payment provider

This is the second origin of the WebView Conformance Harness. It is not a real payment provider and handles no real money or card data.

Why a second origin exists

Cookie behaviour is decided by site, meaning registrable domain, not by origin. A different port is not a different site. So proving that a session survives the return from a payment provider genuinely requires a second domain — without one, the tests would pass without testing anything, which is worse than not running them.

This origin plays three parts:

• Mock payment provider. Hosts the 3-D Secure challenge in its four variants: inside an iframe, as a top-level redirect, in a window.open popup, and handed off to a bank app via a custom scheme. Each fails for a different reason, and the top-level-redirect variant is the one behind “I paid and got logged out”.
• Mock identity provider. The far side of an OAuth round trip, so the cross-site hop back can be measured.
• Third-party iframe origin. Where third-party cookies, the Storage Access API and cross-site framing are tested from.

Endpoints

This origin runs the same backend as the primary. /api/_routes lists everything it serves, and /api/health reports which role it believes it is playing.

Safety

Nothing here accepts real credentials or card numbers. The card form uses the published test number 4111 1111 1111 1111 as a placeholder, no network request leaves these two origins, and every “payment” is a signed token whose status is derived from its own age. Do not enter real card details into it — not because it would be captured, but because there is nothing on the other end.