docs: cross-origin hardening warnings on existing iframe pages - #780
Open
justinformentin wants to merge 3 commits into
Open
docs: cross-origin hardening warnings on existing iframe pages#780justinformentin wants to merge 3 commits into
justinformentin wants to merge 3 commits into
Conversation
- Add sdks/advanced/frames-cross-origin-hardening.mdx documenting the breaking change in the import frame (now throws ERROR when organizationId or userId are missing), plus the MessageChannel and postMessage hardening across auth, import, and export-and-sign frames. - Add new page to docs.json nav after iframe-stamper entry. The primary user-facing impact: @turnkey/iframe-stamper < 2.0.0 (or custom integrations omitting organizationId/userId) will now receive an ERROR from the import frame. Fix is to upgrade to >= 2.0.0.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Instead of a standalone page, add concise callouts directly on the affected existing pages: - sdks/advanced/iframe-stamper.mdx: Warning about cross-origin hardening + import breaking change (ERROR when organizationId/userId missing). Upgrade to >= 2.0.0 required. - snippets/shared/import-wallets.mdx: Warning in the Embedded iframe section — breaking change is most relevant here. - snippets/shared/export-wallets.mdx: Note in the Embedded iframe section — cross-origin hardening, no breaking change, upgrade to >= 2.1.0 recommended. - sdks/advanced/client-side-signing.mdx: Note near top — export-and-sign iframe hardening, upgrade to >= 2.1.0 recommended. - docs.json: Revert nav addition (no standalone page any more). changelogs/iframe-stamper/readme.mdx left untouched (tracks npm package releases, not server-side frame deploys).
justinformentin
changed the title
ethankonk
requested changes
Aug 14, 2026
ethankonk
left a comment
ethankonk
left a comment
Contributor
There was a problem hiding this comment.
small nit, can ignore if you want!
Comment on lines
+72
to
+74
| <Note> | ||
| Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later. | ||
| </Note> |
Contributor
There was a problem hiding this comment.
I think a list of higher level SDK versions patching this would also be valuable here, we'd prob want to list the versions of the following SDKs that include this patch:
@turnkey/sdk-browser - technicality, uses frames for session key storage
@turnkey/react-wallet-kit
@turnkey/sdk-react
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds concise callout warnings directly on existing iframe-related pages rather than a standalone page. Four existing pages updated, no new page added.
Changes
sdks/advanced/iframe-stamper.mdxAdded a
<Warning>after the intro: cross-origin hardening security update, import breaking change (ERRORwhenorganizationId/userIdmissing), upgrade to>= 2.0.0required.snippets/shared/import-wallets.mdxAdded a
<Warning>in the Embedded iframe section: breaking change — import iframe now returnsERRORwhen fields are missing, must upgrade to>= 2.0.0.snippets/shared/export-wallets.mdxAdded a
<Note>in the Embedded iframe section: export iframe cross-origin hardening, no breaking change, upgrade to>= 2.1.0recommended. (This snippet is reused byfeatures/wallets/export-wallets.mdx.)sdks/advanced/client-side-signing.mdxAdded a
<Note>near the top: export-and-sign iframe cross-origin hardening, upgrade to>= 2.1.0recommended.docs.jsonReverted the nav entry added in the previous commit (no standalone page).
Not touched
sdks/advanced/frames-cross-origin-hardening.mdx— deleted (was created in first commit, now removed)changelogs/iframe-stamper/readme.mdx— left untouched; tracks npm package releases, not server-side frame deploysfeatures/wallets/import-wallets.mdx/features/wallets/export-wallets.mdx— pure snippet imports; edits went into the snippets instead