From 10ce52ca85ecd9cb3d4c8dbd1ff1ed8edb449ae6 Mon Sep 17 00:00:00 2001 From: Sylvain Lesage Date: Thu, 31 Jul 2025 00:20:13 -0400 Subject: [PATCH] fix postMessage targetOrigin --- src/components/App/App.tsx | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/components/App/App.tsx b/src/components/App/App.tsx index ae3a4d8..d685151 100644 --- a/src/components/App/App.tsx +++ b/src/components/App/App.tsx @@ -87,11 +87,15 @@ export default function App() { * * Note that the iframe has no access to the parent window's location, so * it might already by in sync, we just don't know. + * + * Also, trying to access the parent window's origin will throw an error: + * DOMException: Permission denied to access property "origin" on cross-origin object + * so we cannot test it before sending the message to a specific targetOrigin. + * + * We thus send the message to any origin ('*') and hope that the parent window + * will handle it correctly. */ - const huggingfaceOrigin = 'https://huggingface.co' - if (window.parent.origin === huggingfaceOrigin) { - window.parent.postMessage({ queryString: window.location.search }, huggingfaceOrigin) - } + window.parent.postMessage({ queryString: window.location.search }, '*') return