Upgrading Microform v2 for PCI DSS 4.0.1 Compliance

Introduction

This article explains the required Microform v2 upgrade to comply with Payment Card Industry Data Security Standard (PCI DSS) 4.0.1, specifically requirement 6.4.3. The upgrade introduces Sub-resource Integrity (SRI) Validation when loading the Microform JavaScript library, improving the security of payment card transactions, safeguarding sensitive information, maintaining trust in electronic payment systems, and reducing the likelihood of a data breach.

This content is intended for internal support agents assisting merchants who have integrated with Microform. It applies to all transactions processed through Microform, regardless of region or card network configuration.

Comprehensive Overview

PCI DSS is a widely accepted set of policies and procedures intended to optimize the security of credit, debit, and cash card transactions. Requirement 6.4.3 in PCI DSS 4.0.1 introduces controls around how externally loaded scripts are validated on payment pages.

To comply, the merchant integration must change how the Microform JavaScript library is loaded. Instead of referencing a static, hardcoded library URL, the integration must dynamically load the library using the clientLibrary and clientLibraryIntegrity values returned in the capture context (JWT) from the /sessions response. These values can be unique per transaction and must not be hardcoded.

Integration Comparison

Step-by-Step Procedures

Use the following procedure to update an existing Microform v2 client-side integration so it complies with PCI DSS 4.0.1.

Potential Client Questions and Resolutions

• What is PCI DSS?
  • PCI DSS is a widely accepted set of policies and procedures intended to optimize the security of credit, debit, and cash card transactions. Refer to the official PCI DSS v4.0.1 standard for the full definition: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf
• How do I know what version of Microform I am using?
  • For Microform v2, the version is specified in the clientVersion field within the Generate Capture Context request. Example: {"clientVersion": "v2", "targetOrigins": ["https://www.example.com"], "allowedCardNetworks": ["VISA"]}. The type property is also returned in the transient token response, for example "type": "mf-2.0.0".
• If I am currently using Microform v1 or lower, can I continue to use this version and remain PCI DSS compliant?
  • No. Integrations on Microform v1 or lower cannot leverage the SRI value feature and will no longer be PCI DSS compliant from April 1, 2025. Migration to Microform v2 is required to access the SRI value and remain compliant. Microform v1 and lower will be deprecated and reach end of life on October 1, 2025. After that date, integrations using Microform v0.4 or lower, v0.11, or v1 will no longer work.
• What type of transactions does this impact?
  • This feature impacts all transactions processed through Microform.
• Is this a backwards breaking change?
  • Existing Microform integrations continue to work as normal. However, to remain PCI DSS compliant, the integration must be upgraded to Microform v2 by April 1, 2025. Regardless of the current Microform version, the JavaScript library must be loaded dynamically using the clientLibrary and clientLibraryIntegrity values from the /sessions response, and these values must not be hardcoded.
• I already use Microform v2. Do I need to do anything to remain PCI DSS compliant?
  • Yes. Implement SRI Validation in the HTML by leveraging the client library integrity hash returned in the /sessions response.

Examples and Use Cases

Use Case 1: Merchant Hardcoding the Client Library Value

• Context: A merchant has hardcoded the clientLibrary value into their HTML for Microform integration.
• Expected Outcome: Microform front-end errors occur and the integration risks breaking.
• Support Agent Actions: Direct the merchant to dynamically load the library on the front-end. Confirm they decode the JWT from the /sessions response and use the clientLibrary and clientLibraryIntegrity values to construct script tags per transaction.

Use Case 2: Merchant Using Inconsistent Microform Versions Across API Calls

• Context: A merchant retrieves assets using v2 but makes token requests with v1 or v0.11.
• Expected Outcome: The integration breaks because of version mismatches.
• Support Agent Actions: Confirm the merchant references "clientVersion": "v2" in the /sessions request and uses Microform v2 consistently across all related API calls.

Use Case