Merge pull request #9 from advanced-rest-client/fix/W-13561580/target…

…-origin [W-13561580] Target origin
advanced-rest-client · Jun 9, 2023 · bc4af9e · bc4af9e
2 parents caab4e5 + 95501f4
commit bc4af9e
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 8 deletions.
diff --git a/oauth-popup.html b/oauth-popup.html
@@ -13,15 +13,16 @@ <h1>Sending the authorization data to the application</h1>
     </p>
     <script>
     const messageTarget = (window.opener || window.parent || window.top);
+    const targetOrigin = messageTarget.origin
     if (!messageTarget || messageTarget === window || !messageTarget.postMessage) {
       const elm = document.getElementById('general-error');
       elm.removeAttribute('hidden');
     } else {
       const search = window.location.search.substr(1);
       if (search) {
-        messageTarget.postMessage(search, '*');
+        messageTarget.postMessage(search, targetOrigin);
       } else {
-        messageTarget.postMessage(window.location.hash.substr(1), '*');
+        messageTarget.postMessage(window.location.hash.substr(1), targetOrigin);
       }
     }
     </script>

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@advanced-rest-client/authorization",
   "description": "The UI and logic related to HTTP authorization.",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "license": "Apache-2.0",
   "main": "index.js",
   "module": "index.js",

diff --git a/test/oauth2/popup.html b/test/oauth2/popup.html
@@ -13,15 +13,16 @@ <h1>Sending the authorization data to the application</h1>
     </p>
     <script>
     const messageTarget = (window.opener || window.parent || window.top);
+    const targetOrigin = messageTarget.origin
     if (!messageTarget || messageTarget === window || !messageTarget.postMessage) {
       const elm = document.getElementById('general-error');
       elm.removeAttribute('hidden');
     } else {
       const search = window.location.search.substr(1);
       if (search) {
-        messageTarget.postMessage(search, '*');
+        messageTarget.postMessage(search, targetOrigin);
       } else {
-        messageTarget.postMessage(window.location.hash.substr(1), '*');
+        messageTarget.postMessage(window.location.hash.substr(1), targetOrigin);
       }
     }
     </script>

diff --git a/test/oauth2/wrong-redirect.html b/test/oauth2/wrong-redirect.html
@@ -13,15 +13,16 @@ <h1>Sending the authorization data to the application</h1>
     </p>
     <script>
     const messageTarget = (window.opener || window.parent || window.top);
+    const targetOrigin = messageTarget.origin
     if (!messageTarget || messageTarget === window || !messageTarget.postMessage) {
       const elm = document.getElementById('general-error');
       elm.removeAttribute('hidden');
     } else {
       const search = window.location.search.substr(1);
       if (search) {
-        messageTarget.postMessage(search, '*');
+        messageTarget.postMessage(search, targetOrigin);
       } else {
-        messageTarget.postMessage(window.location.hash.substr(1), '*');
+        messageTarget.postMessage(window.location.hash.substr(1), targetOrigin);
       }
     }
     </script>