@dynamic-labs/sdk-react-core 0.18.28 → 0.18.30

package/CHANGELOG.md

@@ -1,4 +1,20 @@
 
+### [0.18.30](https://github.com/dynamic-labs/DynamicAuth/compare/v0.18.29...v0.18.30) (2023-11-27)
+
+
+### Bug Fixes
+
+* handle origin_check message from authWindow ([#3992](https://github.com/dynamic-labs/DynamicAuth/issues/3992)) ([1f35594](https://github.com/dynamic-labs/DynamicAuth/commit/1f35594fa3b0e10d3e1c6102b82606117a2265e1))
+* null safe check to window object ([#3886](https://github.com/dynamic-labs/DynamicAuth/issues/3886)) ([37b4d36](https://github.com/dynamic-labs/DynamicAuth/commit/37b4d361b61f1045b7a0dc42359eb6cc1ce1b659))
+
+### [0.18.29](https://github.com/dynamic-labs/DynamicAuth/compare/v0.18.28...v0.18.29) (2023-11-13)
+
+
+### Bug Fixes
+
+* **bridge:** disconnect mm when locked offsite ([#3872](https://github.com/dynamic-labs/DynamicAuth/issues/3872)) ([4a34492](https://github.com/dynamic-labs/DynamicAuth/commit/4a344926d2987cd31123b9a5ac9c3dbf1efccbe0))
+* only process oauth message coming from the expected origin ([#3805](https://github.com/dynamic-labs/DynamicAuth/issues/3805)) ([970003c](https://github.com/dynamic-labs/DynamicAuth/commit/970003c81cc101dcca2c4a56c48095303377d8ef))
+
 ### [0.18.28](https://github.com/dynamic-labs/DynamicAuth/compare/v0.18.27...v0.18.28) (2023-10-30)
 
 

package/package.cjs

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "0.18.28";
+var version = "0.18.30";
 var dependencies = {
 	"react-focus-lock": "2.9.2",
 	"@dynamic-labs/iconic": "0.1.32",

package/package.js

@@ -1,4 +1,4 @@
-var version = "0.18.28";
+var version = "0.18.30";
 var dependencies = {
 	"react-focus-lock": "2.9.2",
 	"@dynamic-labs/iconic": "0.1.32",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "0.18.28",
+  "version": "0.18.30",
   "repository": {
     "type": "git",
     "url": "https://github.com/dynamic-labs/DynamicAuth.git",
@@ -16,13 +16,13 @@
     "formik": "2.2.9",
     "qrcode": "1.5.1",
     "ethers": "5.7.2",
-    "@dynamic-labs/logger": "0.18.28",
-    "@dynamic-labs/multi-wallet": "0.18.28",
-    "@dynamic-labs/rpc-providers": "0.18.28",
-    "@dynamic-labs/types": "0.18.28",
-    "@dynamic-labs/utils": "0.18.28",
-    "@dynamic-labs/wallet-book": "0.18.28",
-    "@dynamic-labs/wallet-connector-core": "0.18.28",
+    "@dynamic-labs/logger": "0.18.30",
+    "@dynamic-labs/multi-wallet": "0.18.30",
+    "@dynamic-labs/rpc-providers": "0.18.30",
+    "@dynamic-labs/types": "0.18.30",
+    "@dynamic-labs/utils": "0.18.30",
+    "@dynamic-labs/wallet-book": "0.18.30",
+    "@dynamic-labs/wallet-connector-core": "0.18.30",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/lib/context/DynamicContext/DynamicContext.cjs

@@ -190,6 +190,7 @@ const DynamicContextProvider = ({ children, theme, settings, }) => {
         clearPrimaryWalletId,
         enableVisitTrackingOnConnectOnly,
         environmentId,
+        isBridgeFlow,
         onBeforeConnectSuccessConfirmation: eventsCallbacks === null || eventsCallbacks === void 0 ? void 0 : eventsCallbacks.onBeforeConnectSuccessConfirmation,
         onUnlink: (walletId, connectedWalletsInfo) => {
             const missingChains = getMissingChains.getMissingChains(walletsByChain, connectedWalletsInfo);

package/src/lib/context/DynamicContext/DynamicContext.js

@@ -186,6 +186,7 @@ const DynamicContextProvider = ({ children, theme, settings, }) => {
         clearPrimaryWalletId,
         enableVisitTrackingOnConnectOnly,
         environmentId,
+        isBridgeFlow,
         onBeforeConnectSuccessConfirmation: eventsCallbacks === null || eventsCallbacks === void 0 ? void 0 : eventsCallbacks.onBeforeConnectSuccessConfirmation,
         onUnlink: (walletId, connectedWalletsInfo) => {
             const missingChains = getMissingChains(walletsByChain, connectedWalletsInfo);

package/src/lib/utils/functions/getProviderByType/getProviderByType.cjs

@@ -0,0 +1,7 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+const getProviderByType = (providers, providerType) => providers.find((p) => p.provider === providerType);
+
+exports.getProviderByType = getProviderByType;

package/src/lib/utils/functions/getProviderByType/getProviderByType.d.ts

@@ -0,0 +1,2 @@
+import { Provider, ProviderEnum } from '@dynamic-labs/sdk-api';
+export declare const getProviderByType: (providers: Provider[], providerType: ProviderEnum) => Provider | undefined;

package/src/lib/utils/functions/getProviderByType/getProviderByType.js

@@ -0,0 +1,3 @@
+const getProviderByType = (providers, providerType) => providers.find((p) => p.provider === providerType);
+
+export { getProviderByType };

package/src/lib/utils/functions/getProviderByType/index.d.ts

@@ -0,0 +1 @@
+export { getProviderByType } from './getProviderByType';

package/src/lib/utils/functions/index.d.ts

@@ -28,3 +28,4 @@ export * from './digestSHA256';
 export * from './encodeBase64URL';
 export * from './getRedirectURIOrigin';
 export * from './sendTransactionWithAutoNonce';
+export * from './getProviderByType';

package/src/lib/utils/hooks/useConnectWallet/useConnectWallet.cjs

@@ -23,9 +23,35 @@ var api = require('../../../data/api.cjs');
 require('@dynamic-labs/multi-wallet');
 var shouldManuallyReconnectOnRefresh = require('../../functions/shouldManuallyReconnectOnRefresh/shouldManuallyReconnectOnRefresh.cjs');
 
-const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, }) => {
+const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, isBridgeFlow, }) => {
     const [connectedWalletsInfo, setConnectedWalletsInfo, removeConnectedWalletsInfo,] = useLocalStorage.useLocalStorage(localStorage.CONNECTED_WALLETS_INFO, []);
     const [connectedWallets, setConnectedWallets] = React.useState([]);
+    const unlinkConnectedWallet = React.useCallback((walletId) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
+        const connectedWalletToUnlink = connectedWallets.find((wallet) => wallet.id === walletId);
+        yield (connectedWalletToUnlink === null || connectedWalletToUnlink === void 0 ? void 0 : connectedWalletToUnlink.connector.endSession());
+        const filteredWallets = connectedWalletsInfo.filter((wallet) => wallet.id !== walletId);
+        setConnectedWalletsInfo(filteredWallets);
+        onUnlink === null || onUnlink === void 0 ? void 0 : onUnlink(walletId, filteredWallets);
+        if (walletId !== primaryWalletId) {
+            return;
+        }
+        const hasConnectedWallet = filteredWallets.length > 0;
+        if (isBridgeFlow || !hasConnectedWallet) {
+            clearPrimaryWalletId();
+        }
+        else {
+            setPrimaryWalletId(filteredWallets[0].id);
+        }
+    }), [
+        clearPrimaryWalletId,
+        connectedWallets,
+        connectedWalletsInfo,
+        isBridgeFlow,
+        onUnlink,
+        primaryWalletId,
+        setConnectedWalletsInfo,
+        setPrimaryWalletId,
+    ]);
     // The function to update and define the connectedWallets list.
     // It uses walletConnector to get the current wallet address and network
     // The address and network in the runtime are updated by the event listeners
@@ -41,9 +67,14 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
             if (!walletConnector) {
                 walletConnectorCore.logger.error('Could not find walletConnector: ' +
                     storedConnectedWalletInfo.walletConnectorKey);
+                yield unlinkConnectedWallet(storedConnectedWalletInfo.id);
                 return Promise.resolve(null);
             }
             const [walletAddress] = yield walletConnector.getConnectedAccounts();
+            if (!walletAddress) {
+                yield unlinkConnectedWallet(storedConnectedWalletInfo.id);
+                return null;
+            }
             const walletNetwork = yield walletConnector.getNetwork();
             const walletChain = walletConnector.connectedChain;
             const walletObject = {
@@ -57,11 +88,12 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
             return Promise.resolve(walletObject);
         })))).filter((wallet) => Boolean(wallet));
         setConnectedWallets(nextConnectedWallets);
-    }), [connectedWalletsInfo, wallets]);
+    }), [connectedWalletsInfo, unlinkConnectedWallet, wallets]);
     // Generate the connectedWallets list when connectedWalletsInfo (localStorage) or memoized wallet connector updates
     React.useEffect(() => {
         updateConnectedWalletsList();
-    }, [updateConnectedWalletsList]);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [connectedWalletsInfo, wallets]);
     const getNextIdAvailable = React.useCallback((currentWallets) => {
         const existingIds = currentWallets.map(({ id }) => id);
         const sortedIds = existingIds
@@ -173,16 +205,6 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
         }
         return Promise.resolve(publicWalletAddress);
     });
-    const unlinkConnectedWallet = (walletId) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
-        const connectedWalletToUnlink = connectedWallets.find((wallet) => wallet.id === walletId);
-        yield (connectedWalletToUnlink === null || connectedWalletToUnlink === void 0 ? void 0 : connectedWalletToUnlink.connector.endSession());
-        const filteredWallets = connectedWalletsInfo.filter((wallet) => wallet.id !== walletId);
-        if (walletId === primaryWalletId) {
-            clearPrimaryWalletId();
-        }
-        setConnectedWalletsInfo(filteredWallets);
-        onUnlink === null || onUnlink === void 0 ? void 0 : onUnlink(walletId, filteredWallets);
-    });
     const getConnectedWalletById = React.useCallback((walletId) => connectedWallets.find((wallet) => wallet.id === walletId), [connectedWallets]);
     return {
         connectWallet,

package/src/lib/utils/hooks/useConnectWallet/useConnectWallet.d.ts

@@ -18,8 +18,9 @@ type Props = {
     onUnlink?: (walletId: string, connectedWalletsInfo: ConnectedWalletConnectorType[]) => void;
     onBeforeConnectSuccessConfirmation: OnBeforeConnectSuccessConfirmation | undefined;
     setShowAuthFlow: Dispatch<SetStateAction<boolean>>;
+    isBridgeFlow: boolean;
 };
-export declare const useConnectWallet: ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, }: Props) => {
+export declare const useConnectWallet: ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, isBridgeFlow, }: Props) => {
     connectWallet: (walletConnector: WalletConnector, fetchPublicAddressOpts?: FetchPublicAddressOpts, shouldCallCallback?: boolean) => Promise<string | undefined>;
     connectedWallet: Wallet;
     connectedWallets: Wallet[];

package/src/lib/utils/hooks/useConnectWallet/useConnectWallet.js

@@ -19,9 +19,35 @@ import { createVisit } from '../../../data/api.js';
 import '@dynamic-labs/multi-wallet';
 import { shouldManuallyReconnectOnRefresh } from '../../functions/shouldManuallyReconnectOnRefresh/shouldManuallyReconnectOnRefresh.js';
 
-const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, }) => {
+const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingOnConnectOnly, environmentId, primaryWalletId, setPrimaryWalletId, wallets, onUnlink, onBeforeConnectSuccessConfirmation, setShowAuthFlow, isBridgeFlow, }) => {
     const [connectedWalletsInfo, setConnectedWalletsInfo, removeConnectedWalletsInfo,] = useLocalStorage(CONNECTED_WALLETS_INFO, []);
     const [connectedWallets, setConnectedWallets] = useState([]);
+    const unlinkConnectedWallet = useCallback((walletId) => __awaiter(void 0, void 0, void 0, function* () {
+        const connectedWalletToUnlink = connectedWallets.find((wallet) => wallet.id === walletId);
+        yield (connectedWalletToUnlink === null || connectedWalletToUnlink === void 0 ? void 0 : connectedWalletToUnlink.connector.endSession());
+        const filteredWallets = connectedWalletsInfo.filter((wallet) => wallet.id !== walletId);
+        setConnectedWalletsInfo(filteredWallets);
+        onUnlink === null || onUnlink === void 0 ? void 0 : onUnlink(walletId, filteredWallets);
+        if (walletId !== primaryWalletId) {
+            return;
+        }
+        const hasConnectedWallet = filteredWallets.length > 0;
+        if (isBridgeFlow || !hasConnectedWallet) {
+            clearPrimaryWalletId();
+        }
+        else {
+            setPrimaryWalletId(filteredWallets[0].id);
+        }
+    }), [
+        clearPrimaryWalletId,
+        connectedWallets,
+        connectedWalletsInfo,
+        isBridgeFlow,
+        onUnlink,
+        primaryWalletId,
+        setConnectedWalletsInfo,
+        setPrimaryWalletId,
+    ]);
     // The function to update and define the connectedWallets list.
     // It uses walletConnector to get the current wallet address and network
     // The address and network in the runtime are updated by the event listeners
@@ -37,9 +63,14 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
             if (!walletConnector) {
                 logger.error('Could not find walletConnector: ' +
                     storedConnectedWalletInfo.walletConnectorKey);
+                yield unlinkConnectedWallet(storedConnectedWalletInfo.id);
                 return Promise.resolve(null);
             }
             const [walletAddress] = yield walletConnector.getConnectedAccounts();
+            if (!walletAddress) {
+                yield unlinkConnectedWallet(storedConnectedWalletInfo.id);
+                return null;
+            }
             const walletNetwork = yield walletConnector.getNetwork();
             const walletChain = walletConnector.connectedChain;
             const walletObject = {
@@ -53,11 +84,12 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
             return Promise.resolve(walletObject);
         })))).filter((wallet) => Boolean(wallet));
         setConnectedWallets(nextConnectedWallets);
-    }), [connectedWalletsInfo, wallets]);
+    }), [connectedWalletsInfo, unlinkConnectedWallet, wallets]);
     // Generate the connectedWallets list when connectedWalletsInfo (localStorage) or memoized wallet connector updates
     useEffect(() => {
         updateConnectedWalletsList();
-    }, [updateConnectedWalletsList]);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [connectedWalletsInfo, wallets]);
     const getNextIdAvailable = useCallback((currentWallets) => {
         const existingIds = currentWallets.map(({ id }) => id);
         const sortedIds = existingIds
@@ -169,16 +201,6 @@ const useConnectWallet = ({ authMode, clearPrimaryWalletId, enableVisitTrackingO
         }
         return Promise.resolve(publicWalletAddress);
     });
-    const unlinkConnectedWallet = (walletId) => __awaiter(void 0, void 0, void 0, function* () {
-        const connectedWalletToUnlink = connectedWallets.find((wallet) => wallet.id === walletId);
-        yield (connectedWalletToUnlink === null || connectedWalletToUnlink === void 0 ? void 0 : connectedWalletToUnlink.connector.endSession());
-        const filteredWallets = connectedWalletsInfo.filter((wallet) => wallet.id !== walletId);
-        if (walletId === primaryWalletId) {
-            clearPrimaryWalletId();
-        }
-        setConnectedWalletsInfo(filteredWallets);
-        onUnlink === null || onUnlink === void 0 ? void 0 : onUnlink(walletId, filteredWallets);
-    });
     const getConnectedWalletById = useCallback((walletId) => connectedWallets.find((wallet) => wallet.id === walletId), [connectedWallets]);
     return {
         connectWallet,

package/src/lib/utils/hooks/usePrimaryWalletId/usePrimaryWalletId.cjs

@@ -25,10 +25,10 @@ const usePrimaryWalletId = (internalEvents) => {
     const setPrimaryWalletId = React.useCallback((walletId) => {
         setPrimaryWalletIdState(walletId);
     }, [setPrimaryWalletIdState]);
-    const clearPrimaryWalletId = () => {
+    const clearPrimaryWalletId = React.useCallback(() => {
         clearPrimaryWalletIdStorage();
         internalEvents.emit('clearPrimaryWallet');
-    };
+    }, [clearPrimaryWalletIdStorage, internalEvents]);
     return {
         clearPrimaryWalletId,
         primaryWalletId,

package/src/lib/utils/hooks/usePrimaryWalletId/usePrimaryWalletId.js

@@ -21,10 +21,10 @@ const usePrimaryWalletId = (internalEvents) => {
     const setPrimaryWalletId = useCallback((walletId) => {
         setPrimaryWalletIdState(walletId);
     }, [setPrimaryWalletIdState]);
-    const clearPrimaryWalletId = () => {
+    const clearPrimaryWalletId = useCallback(() => {
         clearPrimaryWalletIdStorage();
         internalEvents.emit('clearPrimaryWallet');
-    };
+    }, [clearPrimaryWalletIdStorage, internalEvents]);
     return {
         clearPrimaryWalletId,
         primaryWalletId,

package/src/lib/utils/hooks/useSocialAccounts/useSocialAccounts.cjs

@@ -29,6 +29,7 @@ var stringifyURIQuery = require('../../functions/stringifyURIQuery/stringifyURIQ
 var digestSHA256 = require('../../functions/digestSHA256/digestSHA256.cjs');
 var encodeBase64URL = require('../../functions/encodeBase64URL/encodeBase64URL.cjs');
 var getRedirectURIOrigin = require('../../functions/getRedirectURIOrigin/getRedirectURIOrigin.cjs');
+var getProviderByType = require('../../functions/getProviderByType/getProviderByType.cjs');
 
 const socialProviders = [
     'discord',
@@ -136,28 +137,60 @@ const useSocialAccounts = ({ sessionTimeout } = {
             providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: false });
         };
         const handleAuthWindowMessage = (event) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
-            var _c;
+            var _c, _d;
             const message = event.data;
+            const apiProvider = getProviderByType.getProviderByType((_c = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.providers) !== null && _c !== void 0 ? _c : [], provider);
+            if (!(apiProvider === null || apiProvider === void 0 ? void 0 : apiProvider.redirectUrl)) {
+                return;
+            }
+            let expectedOrigin = '';
+            try {
+                const redirectUri = new URL(apiProvider.redirectUrl);
+                expectedOrigin = redirectUri.origin;
+            }
+            catch (e) {
+                logger.logger.error('Failed to parse social provider redirect url', {
+                    error: e,
+                });
+                return;
+            }
+            if ((message === null || message === void 0 ? void 0 : message.type) === 'origin_check' && authWindow) {
+                logger.logger.debug('Origin check message received. Sending response now.', {
+                    data: message,
+                    expectedOrigin,
+                });
+                authWindow.postMessage('origin_check_response', expectedOrigin);
+                return;
+            }
             const isAuthorizationMessage = (message === null || message === void 0 ? void 0 : message.type) === 'authorization_response';
             if (isAuthorizationMessage) {
                 logger.logger.debug('Message received', { data: message });
             }
-            const isValidMessage = isAuthorizationMessage && (message === null || message === void 0 ? void 0 : message.provider) === provider;
+            const isExpectedOrigin = event.origin === expectedOrigin;
+            const isValidMessage = isAuthorizationMessage &&
+                (message === null || message === void 0 ? void 0 : message.provider) === provider &&
+                isExpectedOrigin;
             // don't process imvalid messages for provider
             if (!isValidMessage) {
                 return;
             }
             setIsProcessing(true);
-            if (!((_c = providersWaitingOauthMessages.current) === null || _c === void 0 ? void 0 : _c[provider])) {
+            if (!((_d = providersWaitingOauthMessages.current) === null || _d === void 0 ? void 0 : _d[provider])) {
                 handleError(`Linking ${provider} account session timeout.`);
                 return;
             }
             clearListeners();
-            const { code, error } = message;
+            const { code, error, state: authState } = message;
             if (error && error !== 'undefined') {
                 handleError(`Failed to link ${provider} social account: ${error}`);
                 return;
             }
+            // check that the state we receive from message is the same state we calculated earlier
+            // this could be an attack
+            if (state !== authState) {
+                handleError(`Failed to link ${provider} social account: invalid auth state`);
+                return;
+            }
             if (!code) {
                 handleError(`Failed to link ${provider} social account: no authorization code`);
                 return;
@@ -184,19 +217,23 @@ const useSocialAccounts = ({ sessionTimeout } = {
         // different origins (our api redirect page and the app where the sdk is running)
         const oauthIFrameUrl = `${getRedirectURIOrigin.getRedirectURIOrigin(loginUrl)}/sdkoauth`;
         addOAuthIFrame(oauthIFrameUrl);
-        let oauthLoginUrl = loginUrl;
+        if (!((_b = providersWaitingOauthMessages.current) === null || _b === void 0 ? void 0 : _b[provider])) {
+            window.addEventListener('message', handleAuthWindowMessage);
+            providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: true });
+        }
+        // add state param for all providers
+        const stateParam = stringifyURIQuery.stringifyURIQuery({
+            state,
+        });
+        let oauthLoginUrl = `${loginUrl}&${stateParam}`;
+        // only add pkce params for providers that support/require it
         if (providersRequiringPkce.includes(provider)) {
             const digest = yield digestSHA256.digestSHA256(verifier);
             const pkceParams = stringifyURIQuery.stringifyURIQuery({
                 code_challenge: encodeBase64URL.encodeBase64URL(digest),
                 code_challenge_method: 'S256',
-                state: state,
             });
-            oauthLoginUrl = `${loginUrl}&${pkceParams}`;
-        }
-        if (!((_b = providersWaitingOauthMessages.current) === null || _b === void 0 ? void 0 : _b[provider])) {
-            window.addEventListener('message', handleAuthWindowMessage);
-            providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: true });
+            oauthLoginUrl = `${oauthLoginUrl}&${pkceParams}`;
         }
         const authWindow = window.open(oauthLoginUrl, '_blank', 'width=500,height=600');
         if (!providersWithoutWindowOpenerRefence.includes(provider)) {
@@ -225,7 +262,7 @@ const useSocialAccounts = ({ sessionTimeout } = {
         }
     });
     const unlinkSocialAccount = (provider) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
-        var _d;
+        var _e;
         setError(undefined);
         setIsProcessing(true);
         if (!checkValidProvider(provider)) {
@@ -241,7 +278,7 @@ const useSocialAccounts = ({ sessionTimeout } = {
             const jwt = yield api.unlinkOAuth({
                 environmentId,
                 primaryWalletId,
-                verifiedCrentialId: (_d = verifiedCredential.id) !== null && _d !== void 0 ? _d : '',
+                verifiedCrentialId: (_e = verifiedCredential.id) !== null && _e !== void 0 ? _e : '',
             }, String(userJwt));
             if (!jwt) {
                 handleError(`Failed to unlink social account: ${provider} | ${verifiedCredential.id}`);

package/src/lib/utils/hooks/useSocialAccounts/useSocialAccounts.js

@@ -25,6 +25,7 @@ import { stringifyURIQuery } from '../../functions/stringifyURIQuery/stringifyUR
 import { digestSHA256 } from '../../functions/digestSHA256/digestSHA256.js';
 import { encodeBase64URL } from '../../functions/encodeBase64URL/encodeBase64URL.js';
 import { getRedirectURIOrigin } from '../../functions/getRedirectURIOrigin/getRedirectURIOrigin.js';
+import { getProviderByType } from '../../functions/getProviderByType/getProviderByType.js';
 
 const socialProviders = [
     'discord',
@@ -132,28 +133,60 @@ const useSocialAccounts = ({ sessionTimeout } = {
             providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: false });
         };
         const handleAuthWindowMessage = (event) => __awaiter(void 0, void 0, void 0, function* () {
-            var _c;
+            var _c, _d;
             const message = event.data;
+            const apiProvider = getProviderByType((_c = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.providers) !== null && _c !== void 0 ? _c : [], provider);
+            if (!(apiProvider === null || apiProvider === void 0 ? void 0 : apiProvider.redirectUrl)) {
+                return;
+            }
+            let expectedOrigin = '';
+            try {
+                const redirectUri = new URL(apiProvider.redirectUrl);
+                expectedOrigin = redirectUri.origin;
+            }
+            catch (e) {
+                logger.error('Failed to parse social provider redirect url', {
+                    error: e,
+                });
+                return;
+            }
+            if ((message === null || message === void 0 ? void 0 : message.type) === 'origin_check' && authWindow) {
+                logger.debug('Origin check message received. Sending response now.', {
+                    data: message,
+                    expectedOrigin,
+                });
+                authWindow.postMessage('origin_check_response', expectedOrigin);
+                return;
+            }
             const isAuthorizationMessage = (message === null || message === void 0 ? void 0 : message.type) === 'authorization_response';
             if (isAuthorizationMessage) {
                 logger.debug('Message received', { data: message });
             }
-            const isValidMessage = isAuthorizationMessage && (message === null || message === void 0 ? void 0 : message.provider) === provider;
+            const isExpectedOrigin = event.origin === expectedOrigin;
+            const isValidMessage = isAuthorizationMessage &&
+                (message === null || message === void 0 ? void 0 : message.provider) === provider &&
+                isExpectedOrigin;
             // don't process imvalid messages for provider
             if (!isValidMessage) {
                 return;
             }
             setIsProcessing(true);
-            if (!((_c = providersWaitingOauthMessages.current) === null || _c === void 0 ? void 0 : _c[provider])) {
+            if (!((_d = providersWaitingOauthMessages.current) === null || _d === void 0 ? void 0 : _d[provider])) {
                 handleError(`Linking ${provider} account session timeout.`);
                 return;
             }
             clearListeners();
-            const { code, error } = message;
+            const { code, error, state: authState } = message;
             if (error && error !== 'undefined') {
                 handleError(`Failed to link ${provider} social account: ${error}`);
                 return;
             }
+            // check that the state we receive from message is the same state we calculated earlier
+            // this could be an attack
+            if (state !== authState) {
+                handleError(`Failed to link ${provider} social account: invalid auth state`);
+                return;
+            }
             if (!code) {
                 handleError(`Failed to link ${provider} social account: no authorization code`);
                 return;
@@ -180,19 +213,23 @@ const useSocialAccounts = ({ sessionTimeout } = {
         // different origins (our api redirect page and the app where the sdk is running)
         const oauthIFrameUrl = `${getRedirectURIOrigin(loginUrl)}/sdkoauth`;
         addOAuthIFrame(oauthIFrameUrl);
-        let oauthLoginUrl = loginUrl;
+        if (!((_b = providersWaitingOauthMessages.current) === null || _b === void 0 ? void 0 : _b[provider])) {
+            window.addEventListener('message', handleAuthWindowMessage);
+            providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: true });
+        }
+        // add state param for all providers
+        const stateParam = stringifyURIQuery({
+            state,
+        });
+        let oauthLoginUrl = `${loginUrl}&${stateParam}`;
+        // only add pkce params for providers that support/require it
         if (providersRequiringPkce.includes(provider)) {
             const digest = yield digestSHA256(verifier);
             const pkceParams = stringifyURIQuery({
                 code_challenge: encodeBase64URL(digest),
                 code_challenge_method: 'S256',
-                state: state,
             });
-            oauthLoginUrl = `${loginUrl}&${pkceParams}`;
-        }
-        if (!((_b = providersWaitingOauthMessages.current) === null || _b === void 0 ? void 0 : _b[provider])) {
-            window.addEventListener('message', handleAuthWindowMessage);
-            providersWaitingOauthMessages.current = Object.assign(Object.assign({}, providersWaitingOauthMessages.current), { [provider]: true });
+            oauthLoginUrl = `${oauthLoginUrl}&${pkceParams}`;
         }
         const authWindow = window.open(oauthLoginUrl, '_blank', 'width=500,height=600');
         if (!providersWithoutWindowOpenerRefence.includes(provider)) {
@@ -221,7 +258,7 @@ const useSocialAccounts = ({ sessionTimeout } = {
         }
     });
     const unlinkSocialAccount = (provider) => __awaiter(void 0, void 0, void 0, function* () {
-        var _d;
+        var _e;
         setError(undefined);
         setIsProcessing(true);
         if (!checkValidProvider(provider)) {
@@ -237,7 +274,7 @@ const useSocialAccounts = ({ sessionTimeout } = {
             const jwt = yield unlinkOAuth({
                 environmentId,
                 primaryWalletId,
-                verifiedCrentialId: (_d = verifiedCredential.id) !== null && _d !== void 0 ? _d : '',
+                verifiedCrentialId: (_e = verifiedCredential.id) !== null && _e !== void 0 ? _e : '',
             }, String(userJwt));
             if (!jwt) {
                 handleError(`Failed to unlink social account: ${provider} | ${verifiedCredential.id}`);