penpot

mirror of https://github.com/penpot/penpot.git synced 2026-08-19 03:08:40 +00:00

History

Andrey Antukh d80cb5f2dc 🐛 Fix plugin origin check breaking cross-origin plugin messaging

The origin check added in the previous commit compared event.origin
against window.location.origin (Penpot own origin). Since plugins
are cross-origin by design (hosted on the plugin author domain),
this check rejected every legitimate message from every real plugin.

The event.source-based sender routing (matching iframeWindow identity)
is the correct and sufficient security mechanism - it cannot be forged
cross-origin, so the redundant origin check was removed.

- Removed event.origin check from load-plugin.ts message listener
- Updated tests to use realistic plugin origins (localhost:4202/4203)
  and to verify rejection based on source identity, not origin
- Fixed documentation examples: use event.source for receiving
  validation and '*' for postMessage targetOrigin

AI-assisted-by: mimo-v2.5-pro

2026-08-17 10:37:03 +00:00

api.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

beta-changelog.md

📚 Fix links related to penpot plugins

2026-01-27 20:59:54 +01:00

create-a-plugin.md

🐛 Fix plugin origin check breaking cross-origin plugin messaging

2026-08-17 10:37:03 +00:00

deployment.md

📚 Improve plugin deployment documentation (#10544 )