HTML provided by the ACS.
This field contains HTML provided by the ACS in the Challenge Response Message (CRes). This will be populated when the ACSUIType is HTML.
As per the EMVCo 3-D Secure specification, the HTML UI is presented to the cardholder via a web view which remains in control of the app. The app must intercept any remote URL requests made from within the web view, and instead handle them within the app. Preventing the cardholder from making requests in the web view to another server is critical to the security of the environment. According to the EMVCo specification, intercepting these requests has two effects:
- Prevents malicious HTML from redirecting a user to a phishing site.
- Conceptually puts the web view form under the control of the ACS, rather than the app.
- The web view element is not utilized as a browser, but as a UI element whose content is provided by the ACS.
This property is read-only.