fix(security): validate postMessage origins and fix slack middleware path

Senders (typeform, slack, smartling, jira standalone): replaced wildcard
'*' with document.referrer-based origin so tokens are only sent to the
known opener page.

Receivers (typeform, slack, smartling, jira): added event.origin checks
so fake postMessage injections from other pages are rejected.

Slack lambda: changed 'api/tokens' to '/api/tokens' in the middleware
mount array — the missing leading slash meant path-to-regexp@0.1.x never
matched the route, silently bypassing request verification on POST /api/tokens.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

apps/jira/jira-app/src/components/Auth/OAuth.tsx

@@ -27,8 +27,9 @@ export default class OAuth extends React.Component<Props> {
 
     const oauthWindow = window.open(url, 'Jira Contentful', 'left=150,top=10,width=800,height=900');
 
+    const expectedOrigin = new URL(constants.OAUTH_REDIRECT_URI).origin;
     window.addEventListener('message', (e) => {
-      if (e.source !== oauthWindow) {
+      if (e.source !== oauthWindow || e.origin !== expectedOrigin) {
         return;
       }
 

apps/jira/jira-app/src/standalone.ts

@@ -5,7 +5,10 @@ const standalone = (window: Window) => {
     const error = searchParams.get('error');
 
     if (error) {
-      window.opener.postMessage({ error }, '*');
+      window.opener.postMessage(
+        { error },
+        document.referrer ? new URL(document.referrer).origin : window.location.origin
+      );
       return;
     }
 
@@ -14,11 +17,17 @@ const standalone = (window: Window) => {
 
     const expireTime = Date.now() + expiresIn * 1000;
 
-    window.opener.postMessage({ token, expireTime }, '*');
+    window.opener.postMessage(
+      { token, expireTime },
+      document.referrer ? new URL(document.referrer).origin : window.location.origin
+    );
 
     window.history.replaceState({}, 'oauth', '/');
   } else {
-    window.opener.postMessage({ error: 'No query string provided!' }, '*');
+    window.opener.postMessage(
+      { error: 'No query string provided!' },
+      document.referrer ? new URL(document.referrer).origin : window.location.origin
+    );
   }
 };
 export default standalone;

apps/slack/frontend/src/index.tsx

@@ -9,13 +9,16 @@ import { CustomSDKProvider } from './CustomSDKProvider';
 const params = new URLSearchParams(window.location.search);
 
 if (params.has('result')) {
-  window.opener.postMessage({
-    result: params.get('result'),
-    state: params.get('state'),
-    accessToken: params.get('accessToken'),
-    refreshToken: params.get('refreshToken'),
-    errorMessage: params.get('errorMessage'),
-  });
+  window.opener.postMessage(
+    {
+      result: params.get('result'),
+      state: params.get('state'),
+      accessToken: params.get('accessToken'),
+      refreshToken: params.get('refreshToken'),
+      errorMessage: params.get('errorMessage'),
+    },
+    document.referrer ? new URL(document.referrer).origin : window.location.origin
+  );
   window.close();
 } else {
   const root = document.getElementById('root');

apps/slack/frontend/src/useConnect.ts

@@ -2,7 +2,7 @@ import { useCallback, useContext, useEffect } from 'react';
 import { ConnectedWorkspace, useWorkspaceStore, WorkspaceState } from './workspace.store';
 import { apiClient, slackClient } from './requests';
 import { openPopup } from './helpers';
-import { makeOAuthURL } from './constants';
+import { makeOAuthURL, BACKEND_BASE_URL } from './constants';
 import { getEnvironmentName } from './utils';
 import { SDKContext, useCMA, useSDK } from '@contentful/react-apps-toolkit';
 import { AppExtensionSDK } from '@contentful/app-sdk';
@@ -63,6 +63,10 @@ export const useConnect = () => {
   const [setTemporaryRefreshToken] = useAuthStore((state) => [state.setTemporaryRefreshToken]);
 
   const onMessage = async (message: MessageEvent) => {
+    const expectedOrigin = new URL(BACKEND_BASE_URL).origin;
+    if (message.origin !== expectedOrigin) {
+      return;
+    }
     if (message.data.result === 'error') {
       sdk.notifier.error('Something went wrong while authenticating with Slack. Please try again.');
     }

apps/slack/lambda/lib/app.ts

@@ -52,7 +52,7 @@ export function bootstrap(): serverless.Application {
 
   app.use(createServerlessMiddleware(config.serverless));
   app.use(
-    ['/api/messages', '/api/spaces/*', '/api/events', 'api/tokens'],
+    ['/api/messages', '/api/spaces/*', '/api/events', '/api/tokens'],
     createContentfulRequestVerificationMiddleware(config.signingSecret)
   );
   app.use('/api/slack-events', createSlackEventsMiddleware(config.slack, authTokenRepository));

apps/smartling/frontend/src/Sidebar.tsx

@@ -177,8 +177,8 @@ export default class Sidebar extends React.Component<Props, State> {
     } else if (refresh.failed) {
       const smartlingWindow = window.open('/openauth', '', 'height=600,width=600,top=50,left=50');
 
-      const listener = ({ data, source }: any) => {
-        if (source !== smartlingWindow) {
+      const listener = ({ data, source, origin }: any) => {
+        if (source !== smartlingWindow || origin !== window.location.origin) {
           return;
         }
 

apps/smartling/frontend/src/standalone.ts

@@ -8,7 +8,10 @@ const standalone = (window: Window) => {
 
     window.localStorage.setItem('token', token);
     window.localStorage.setItem('refreshToken', refreshToken);
-    window.opener.postMessage({ token, refreshToken }, '*');
+    window.opener.postMessage(
+      { token, refreshToken },
+      document.referrer ? new URL(document.referrer).origin : window.location.origin
+    );
   }
 };
 export default standalone;