Iframe webauthn postmessage #2825
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| export const WEBAUTHN_IFRAME_PATH = "#iframe/webauthn"; | ||
|
|
||
| export const webAuthnInIframeFlow = (): Promise<never> => { | ||
| window.addEventListener("message", async (event) => { |
Check warning
Code scanning / CodeQL
Missing origin verification in `postMessage` handler Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 1 day ago
To fix the problem, we need to verify the origin of the incoming message in the postMessage handler. This involves checking the event.origin property against a list of trusted origins before processing the message. This ensures that only messages from trusted sources are handled, mitigating the risk of malicious messages.
The best way to fix the problem without changing existing functionality is to add an origin check at the beginning of the postMessage handler. We will define a list of trusted origins and compare the event.origin against this list. If the origin is not trusted, we will simply return and not process the message.
| @@ -6,2 +6,7 @@ | ||
| window.addEventListener("message", async (event) => { | ||
| const trustedOrigins = ["https://trusted-origin.com"]; | ||
| if (!trustedOrigins.includes(event.origin)) { | ||
| console.warn(`Untrusted origin: ${event.origin}`); | ||
| return; | ||
| } | ||
| // event.source?.postMessage("why does it not work?"); |
Motivation
Changes
Tests
🟡 Some screens were changed