fix(security): validate postMessage origins and fix slack middleware path

Senders (typeform, slack, smartling, jira standalone): replaced wildcard
'*' with document.referrer-based origin so tokens are only sent to the
known opener page.

Receivers (typeform, slack, smartling, jira): added event.origin checks
so fake postMessage injections from other pages are rejected.

Slack lambda: changed 'api/tokens' to '/api/tokens' in the middleware
mount array — the missing leading slash meant path-to-regexp@0.1.x never
matched the route, silently bypassing request verification on POST /api/tokens.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

apps/jira/jira-app/src/components/Auth/OAuth.tsx

@@ -27,8 +27,9 @@ export default class OAuth extends React.Component<Props> {
 
     const oauthWindow = window.open(url, 'Jira Contentful', 'left=150,top=10,width=800,height=900');
 
+    const expectedOrigin = new URL(constants.OAUTH_REDIRECT_URI).origin;
     window.addEventListener('message', (e) => {
-      if (e.source !== oauthWindow) {
+      if (e.source !== oauthWindow || e.origin !== expectedOrigin) {
         return;
       }
 

apps/jira/jira-app/src/index.spec.tsx

@@ -227,7 +227,14 @@ describe('The Jira App Components', () => {
       (window.open as Mock).mockReturnValue(source);
 
       fireEvent.click(oauthButton);
-      fireEvent(window, new MessageEvent('message', { data: { token, expireTime }, source }));
+      fireEvent(
+        window,
+        new MessageEvent('message', {
+          data: { token, expireTime },
+          source,
+          origin: 'https://api.jira.ctfapps.net',
+        })
+      );
 
       expect(window.open).toHaveBeenCalledWith(
         'https://auth.atlassian.com/authorize?audience=api.atlassian.com&client_id=XD9k9QU9VT4Rt26u6lbO3NM0fOqvvXan&scope=read%3Ajira-user%20read%3Ajira-work%20write%3Ajira-work&redirect_uri=https%3A%2F%2Fapi.jira.ctfapps.net%2Fauth&response_type=code&state=http%3A%2F%2Flocalhost%3A3000%2F&prompt=consent',
@@ -249,7 +256,14 @@ describe('The Jira App Components', () => {
       (window.open as Mock).mockReturnValue(source);
 
       fireEvent.click(oauthButton);
-      fireEvent(window, new MessageEvent('message', { data: { error }, source }));
+      fireEvent(
+        window,
+        new MessageEvent('message', {
+          data: { error },
+          source,
+          origin: 'https://api.jira.ctfapps.net',
+        })
+      );
 
       expect(mockSdk.notifier.error).toHaveBeenCalledWith(
         'There was an error authenticating. Please refresh and try again.'
@@ -580,7 +594,7 @@ describe('The Jira App Components', () => {
       standalone(mockWindow as any);
       expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
         { token: '123', expireTime: 10100 },
-        '*'
+        'http://localhost:1234'
       );
       expect(mockWindow.history.replaceState).toHaveBeenCalledWith({}, 'oauth', '/');
     });
@@ -605,7 +619,10 @@ describe('The Jira App Components', () => {
       standalone(mockWindow as any);
 
       expect(mockWindow.localStorage.setItem).toHaveBeenCalledTimes(0);
-      expect(mockWindow.opener.postMessage).toHaveBeenCalledWith({ error: errorMessage }, '*');
+      expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
+        { error: errorMessage },
+        'http://localhost:1234'
+      );
     });
 
     it('should handle no query string', () => {
@@ -629,7 +646,7 @@ describe('The Jira App Components', () => {
       expect(mockWindow.localStorage.setItem).toHaveBeenCalledTimes(0);
       expect(mockWindow.opener.postMessage).toHaveBeenCalledWith(
         { error: 'No query string provided!' },
-        '*'
+        'http://localhost:1234'
       );
     });
   });

apps/jira/jira-app/src/standalone.ts

@@ -1,11 +1,11 @@
 const standalone = (window: Window) => {
-  const { searchParams, search } = new URL(window.location.href);
+  const { searchParams, search, origin } = new URL(window.location.href);
 
   if (search.length) {
     const error = searchParams.get('error');
 
     if (error) {
-      window.opener.postMessage({ error }, '*');
+      window.opener.postMessage({ error }, origin);
       return;
     }
 
@@ -14,11 +14,11 @@ const standalone = (window: Window) => {
 
     const expireTime = Date.now() + expiresIn * 1000;
 
-    window.opener.postMessage({ token, expireTime }, '*');
+    window.opener.postMessage({ token, expireTime }, origin);
 
     window.history.replaceState({}, 'oauth', '/');
   } else {
-    window.opener.postMessage({ error: 'No query string provided!' }, '*');
+    window.opener.postMessage({ error: 'No query string provided!' }, origin);
   }
 };
 export default standalone;

apps/slack/frontend/src/index.tsx

@@ -9,13 +9,16 @@ import { CustomSDKProvider } from './CustomSDKProvider';
 const params = new URLSearchParams(window.location.search);
 
 if (params.has('result')) {
-  window.opener.postMessage({
-    result: params.get('result'),
-    state: params.get('state'),
-    accessToken: params.get('accessToken'),
-    refreshToken: params.get('refreshToken'),
-    errorMessage: params.get('errorMessage'),
-  });
+  window.opener.postMessage(
+    {
+      result: params.get('result'),
+      state: params.get('state'),
+      accessToken: params.get('accessToken'),
+      refreshToken: params.get('refreshToken'),
+      errorMessage: params.get('errorMessage'),
+    },
+    document.referrer ? new URL(document.referrer).origin : window.location.origin
+  );
   window.close();
 } else {
   const root = document.getElementById('root');

apps/slack/frontend/src/useConnect.ts

@@ -2,7 +2,7 @@ import { useCallback, useContext, useEffect } from 'react';
 import { ConnectedWorkspace, useWorkspaceStore, WorkspaceState } from './workspace.store';
 import { apiClient, slackClient } from './requests';
 import { openPopup } from './helpers';
-import { makeOAuthURL } from './constants';
+import { makeOAuthURL, BACKEND_BASE_URL } from './constants';
 import { getEnvironmentName } from './utils';
 import { SDKContext, useCMA, useSDK } from '@contentful/react-apps-toolkit';
 import { AppExtensionSDK } from '@contentful/app-sdk';
@@ -63,6 +63,10 @@ export const useConnect = () => {
   const [setTemporaryRefreshToken] = useAuthStore((state) => [state.setTemporaryRefreshToken]);
 
   const onMessage = async (message: MessageEvent) => {
+    const expectedOrigin = new URL(BACKEND_BASE_URL).origin;
+    if (message.origin !== expectedOrigin) {
+      return;
+    }
     if (message.data.result === 'error') {
       sdk.notifier.error('Something went wrong while authenticating with Slack. Please try again.');
     }

apps/slack/lambda/lib/app.ts

@@ -52,7 +52,7 @@ export function bootstrap(): serverless.Application {
 
   app.use(createServerlessMiddleware(config.serverless));
   app.use(
-    ['/api/messages', '/api/spaces/*', '/api/events', 'api/tokens'],
+    ['/api/messages', '/api/spaces/*', '/api/events', '/api/tokens'],
     createContentfulRequestVerificationMiddleware(config.signingSecret)
   );
   app.use('/api/slack-events', createSlackEventsMiddleware(config.slack, authTokenRepository));

apps/smartling/frontend/src/Sidebar.tsx

@@ -177,8 +177,8 @@ export default class Sidebar extends React.Component<Props, State> {
     } else if (refresh.failed) {
       const smartlingWindow = window.open('/openauth', '', 'height=600,width=600,top=50,left=50');
 
-      const listener = ({ data, source }: any) => {
-        if (source !== smartlingWindow) {
+      const listener = ({ data, source, origin }: any) => {
+        if (source !== smartlingWindow || origin !== window.location.origin) {
           return;
         }
 

apps/smartling/frontend/src/standalone.ts

@@ -8,7 +8,10 @@ const standalone = (window: Window) => {
 
     window.localStorage.setItem('token', token);
     window.localStorage.setItem('refreshToken', refreshToken);
-    window.opener.postMessage({ token, refreshToken }, '*');
+    window.opener.postMessage(
+      { token, refreshToken },
+      document.referrer ? new URL(document.referrer).origin : window.location.origin
+    );
   }
 };
 export default standalone;