Skip to content

v1.1.0 - Cross-Origin REST Routing and Auth Fixes

Choose a tag to compare

View all tags
@batsonjay batsonjay released this 01 Jun 12:59
· 46 commits to main since this release
v1.1.0
57d2e44

What's Changed

Fixed

  • Cross-origin REST routing — All REST API calls (messages, stickers, sounds, moderation, geo restrictions, auth, exports) now correctly route to serverUrl when set. Previously, 13 hooks and components used a hard-coded same-origin base URL, causing 404s when <RelayaChat> was embedded in a third-party host app. RelayaServerContext now distributes serverUrl through the React tree automatically.

  • Cross-origin auth popup — The login popup URL was built from window.location.origin (the host app's domain) instead of serverUrl's origin. For cross-origin embedders, this opened the popup on a domain with no auth route, breaking login entirely. The postMessage origin check had the same problem. Both are fixed: they now use new URL(serverUrl).origin when serverUrl is set.

  • Font-face CSS warning — Removed a broken @font-face declaration that referenced a missing asset and generated a console warning on every load.

Changed

  • buildWsUrl() JSDoc now explicitly notes this helper is for same-origin / iframe use only. Cross-origin SDK consumers should derive their WebSocket URL from serverUrl (replace https:// with wss://).

Removed

  • API_BASE_URL constant removed from config.ts — it was always "" and became dead code after the cross-origin REST routing fix.

Documentation

  • CHANGELOG.md created with entries for all releases.
  • serverUrl prop documentation clarifies it covers both REST and WebSocket connections; Troubleshooting section added for cross-origin 404 errors.
  • Added @relaya-chat/react-native package README.
  • Corrected prop name typos in root README Quick Start examples.

Upgrade Notes

If you are embedding <RelayaChat serverUrl="https://api.relaya.chat" spaceSlug="your-space" /> in a third-party React app, upgrade to v1.1.0 immediately — previous versions silently routed all REST calls and the auth popup to the host app's origin, resulting in 404 errors and broken login.

No API changes — this is a drop-in upgrade.

Assets 2
Loading