embed: handleTurboSignMessage header comment says the signing page posts to '*' (it never does)
Maintainers usually reply within 6 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- Under an hour
- Newbie friendliness
- 82/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- documentation
Research direction
Read packages/embed/src/handleTurboSignMessage.ts first to locate the outdated targetOrigin: '*' comment, then find postEmbeddedCompletion and resolveEmbedderOrigin in the frontend to confirm the actual posting behavior (ancestorOrigins, then referrer, otherwise nothing). Rewrite the comment to match, then add a troubleshooting row to the README documenting the Firefox + referrerpolicy="no-referrer" case. Done when the comment no longer mentions posting to '*' and the README row exists.
Written by the indexing model from the issue text.
Description
packages/embed/src/handleTurboSignMessage.ts says the signing page may post its completion message with targetOrigin: '*'. The signing page (postEmbeddedCompletion / resolveEmbedderOrigin in the frontend) never posts to *. It posts only to an embedder origin it can resolve (location.ancestorOrigins, else the referrer), and posts nothing otherwise.
Consequence worth documenting in the README: in browsers without ancestorOrigins (Firefox), a host page or iframe with referrerpolicy="no-referrer" receives no completion message. Fix the comment and add a README troubleshooting row. Origin and source pinning remain correct as defense in depth.
- Dominant language
- PHP
- Stars
- 1
- Forks
- 0
- Avg merge
- 4d 9h
- Merged PRs (30d)
- 28
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TurboDocx/SDK
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 6 days
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 6 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 6 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 6 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 6 days
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 3 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
-
PHP SDK drops the API path prefix when a custom base URL has no trailing slashPossibly taken @Winoren claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
langgenius/dify#44568 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day