add getEmbeddedKey #64
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andrewkmin
force-pushed
the
andrew/expose-get-embedded-key
branch
from
88a89ca to
22aecef
Compare
r-n-o
reviewed
Mar 16, 2025
Comment on lines
1250
to
1281
| /** | ||
| * Function triggered when GET_EMBEDDED_KEY event is received. | ||
| * @param {string} requestId: idempotency key | ||
| */ | ||
| var onGetEmbeddedKey = async function (requestId) { | ||
| const embeddedKey = await TKHQ.getEmbeddedKey(); | ||
|
|
||
| TKHQ.sendMessageUp("EMBEDDED_KEY", embeddedKey, requestId); | ||
| }; |
Collaborator
There was a problem hiding this comment.
What's the use case for this? This gives the parent page access to the key that's created in the iframe. Parent apps using this would be better served using the parent's local storage since it'd be equivalent security-wise?
The problem I see is that this change applies equally to parent pages who want to use this event, and parent pages who do not. Because this API exists it means we can't guarantee it won't be used.
Collaborator
There was a problem hiding this comment.
This is maybe acceptable for auth, but seems too dangerous for import/export frames. In the export frame, the embedded key decrypts the export bundle so it should be considered especially sensitive.
andrewkmin
force-pushed
the
andrew/expose-get-embedded-key
branch
from
22aecef to
911e6c8
Compare
r-n-o
approved these changes
Mar 31, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
$title
SDK counterpart: tkhq/sdk#533