Skip to content

docs: cross-origin hardening warnings on existing iframe pages #780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
justinformentin wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs: cross-origin hardening warnings on existing iframe pages #780

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6becb36
docs: document frames cross-origin hardening breaking change
justinformentin Aug 14, 2026
8a53539
docs: add cross-origin hardening warnings to existing iframe pages
justinformentin Aug 14, 2026
f58a2c7
docs: rewrite cross-origin callouts to be timeless and factual
justinformentin Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions sdks/advanced/client-side-signing.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ title: "Client-side signing"

This guide covers how to set up client-side signing using Turnkey's `@turnkey/iframe-stamper` package and the `export-and-sign` iframe. This architecture enables secure transaction and message signing directly in the browser without exposing private keys to your application code. Note that mishandling of exported private keys introduces inherent risks; please proceed with caution.

<Note>
Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later.
</Note>

## Overview

Client-side signing allows you to:
Expand Down
4 changes: 4 additions & 0 deletions sdks/advanced/iframe-stamper.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ It leverages the `postMessage` communication mechanism to send and receive messa

By bridging the gap between the iframe's isolated environment and Turnkey's API, the iframe stamper plays a pivotal role in maintaining the integrity and security of the credential while ensuring seamless operation within the iframe context.

<Warning>
Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later. The import flow requires `organizationId` and `userId` in the injected import bundle; bundles that omit these fields are rejected with an `ERROR`.
</Warning>

## Installing

To start using the `@turnkey/iframe-stamper` client, install it as follows:
Expand Down
4 changes: 4 additions & 0 deletions snippets/shared/export-wallets.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ A full reference implementation is available at

### Embedded iframe

<Note>
Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later.
</Note>
Comment on lines +72 to +74

@ethankonk ethankonk Aug 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think a list of higher level SDK versions patching this would also be valuable here, we'd prob want to list the versions of the following SDKs that include this patch:

@turnkey/sdk-browser - technicality, uses frames for session key storage
@turnkey/react-wallet-kit
@turnkey/sdk-react


Turnkey hosts a static export page at `export.turnkey.com` designed to be embedded as an iframe in
your app. The encrypted bundle returned by Turnkey is injected into the iframe, which decrypts and
displays the mnemonic or private key entirely within its own origin — neither your app nor Turnkey
Expand Down
4 changes: 4 additions & 0 deletions snippets/shared/import-wallets.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@ A full reference implementation is available at

### Embedded iframe

<Warning>
Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later. The import flow requires `organizationId` and `userId` in the injected import bundle; bundles that omit these fields are rejected with an `ERROR`.
</Warning>

Turnkey hosts a static import page at `import.turnkey.com` designed to be embedded as an iframe in
your app. The iframe handles encryption of the mnemonic or private key entirely within its own
origin — neither your app nor Turnkey ever sees the plaintext. Use
Expand Down