From 3aea425abc161647117d7a0aa0cd3d74cda8cfa2 Mon Sep 17 00:00:00 2001
From: Vinay Keerthi <11478411+stonecharioteer@users.noreply.github.com>
Date: Mon, 12 Jan 2026 16:34:13 +0530
Subject: [PATCH] fix: handle same-origin deployments in postMessage validation

Fall back to window.location.origin when baseUrl is empty or relative,
supporting same-origin deployments while maintaining origin validation.
---
 app/javascript/sdk/IFrameHelper.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/javascript/sdk/IFrameHelper.js b/app/javascript/sdk/IFrameHelper.js
index 38571c4e5..29f0aa9d3 100644
--- a/app/javascript/sdk/IFrameHelper.js
+++ b/app/javascript/sdk/IFrameHelper.js
@@ -44,12 +44,14 @@ const updateAuthCookie = (cookieContent, baseDomain = '') =>
 
 const getTargetOrigin = () => {
   const { baseUrl } = window.$chatwoot || {};
-  if (!baseUrl) return null;
+  if (!baseUrl) {
+    return window.location.origin;
+  }
   try {
     const url = new URL(baseUrl);
     return url.origin;
   } catch {
-    return null;
+    return window.location.origin;
   }
 };