fix: allow self and widget origin

2025-08-21 17:07:41 +05:30
parent 1505d9ccb8
commit 620b26cddc
1 changed files with 17 additions and 2 deletions
@@ -127,12 +127,27 @@ export const IFrameHelper = {
    window.onmessage = e => {
      if (
        typeof e.data !== 'string' ||
-        e.data.indexOf('chatwoot-widget:') !== 0 ||
-        e.origin !== window.location.origin
+        e.data.indexOf('chatwoot-widget:') !== 0
      ) {
        return;
      }

+      // Validate origin - allow messages from either:
+      // 1. The widget origin (widget -> parent communication)
+      // 2. The current page origin (same-origin messages)
+      const widgetOrigin = window.$chatwoot?.baseUrl
+        ? new URL(window.$chatwoot.baseUrl).origin
+        : null;
+      const parentOrigin = window.location.origin;
+
+      const isValidOrigin =
+        e.origin === parentOrigin ||
+        (widgetOrigin && e.origin === widgetOrigin);
+
+      if (!isValidOrigin) {
+        return;
+      }
+
      const message = JSON.parse(e.data.replace('chatwoot-widget:', ''));
      if (typeof IFrameHelper.events[message.event] === 'function') {
        IFrameHelper.events[message.event](message);