IS-11764 Ignore external browser flow messages from an unexpected origin

[aleixsuau]

Jira: https://curity.atlassian.net/browse/IS-11764

Purpose & Context

The external browser flow opens a second window and waits for a postMessage that carries the resume nonce. Until now, any message from that window with a non-Curity origin rejected the promise. The stepper turns that rejection into a full-screen error boundary, so the login flow died.

That window legitimately visits third-party origins mid-flow — a social login provider, for example. Code on those pages can post a message to its opener. When it did, a working login broke.

Luis confirmed the intended behaviour while reviewing #288: ignore those messages and keep waiting for the real completion message.

Architecture & Data Flow

flowchart TD
    A[message event] --> B{source is the external window?}
    B -- no --> I1[ignore, keep listening]
    B -- yes --> C{origin is the launch origin?}
    C -- no --> I2["ignore, keep listening<br/>(was: reject)"]
    C -- yes --> D{data is a string?}
    D -- no --> E[reject with the resume error]
    D -- yes --> F[resolve with the resume nonce]

Loading

How to Test & Review

Unit tests cover the three paths:

• A message from an unexpected origin is ignored, and a later message from the launch origin still resolves with the nonce (new test).
• A message from another window is ignored (existing test).
• Non-string data from the launch origin still rejects (existing test).

npx vitest run --dir src/haapi-react-sdk

[Copilot]

Pull request overview

Updates external browser flow handling to ignore unexpected-origin messages while preserving strict validation for valid Curity messages.

Changes:

• Separates origin filtering from payload validation.
• Continues waiting after third-party-origin messages.
• Adds coverage for the updated behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Summary
src/haapi-react-sdk/haapi-stepper/feature/actions/client-operation/operations/external-browser-flow/external-browser-flow.ts	Ignores messages from unexpected origins.
src/haapi-react-sdk/haapi-stepper/feature/actions/client-operation/operations/external-browser-flow/external-browser-flow.spec.ts	Tests updated origin-handling behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.