fix(register): gate Turnstile WebView by https scheme, not origin (fixes Android)#3289
Conversation
… (Android)
The merged origin gate (url.startsWith('https://ecency.com/')) breaks Turnstile on
Android. Android's react-native-webview shouldStart event carries no isTopFrame field,
so the handler collapses to "allow only our origin" for every navigation Android routes
through it -- and Android routes the challenge's https iframe (challenges.cloudflare.com)
through it too, so that frame gets cancelled and the challenge never completes.
Gate by scheme instead: allow all sub-frames (iOS reports isTopFrame=false) and allow any
https top-level navigation, which keeps Cloudflare's https iframe working on both platforms
while still blocking a top-level file:/javascript: navigation. iOS behaviour is unchanged
(verified working on TestFlight); this only relaxes the Android-affecting origin check.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e668e00e4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // isTopFrame is iOS-only; on Android the handler only fires for the main frame, so a missing | ||
| // flag is treated as the top frame too. Only the top document is constrained to our origin. | ||
| req.isTopFrame === false || req.url.startsWith(TURNSTILE_ORIGIN); | ||
| req.isTopFrame === false || req.url.startsWith('https://'); |
There was a problem hiding this comment.
When Android delivers a request without a reliable frame signal, this line treats every HTTPS URL as allowed. That fixes the Cloudflare iframe case but also permits any top-level HTTPS navigation initiated by the embed page (for example an external link or redirect) into the same WebView; the WebView messaging bridge is enabled for all origins and _onMessage accepts verify from whatever page is loaded, so such a page can enable the free-register button with arbitrary data instead of keeping the challenge confined to Ecency/Cloudflare. Keep the top document on ecency.com and limit the Android no-frame-signal exception to the known Turnstile host(s), rather than whitelisting all HTTPS origins.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in 90682d6. Pinned the top document to the two hosts the widget actually loads -- https://ecency.com/ (embed page) and https://challenges.cloudflare.com/ (the challenge) -- instead of allowing any https. So a stray top-level navigation to an arbitrary https page can no longer load and post a fake verify token over the bridge. challenges.cloudflare.com is allow-listed explicitly so the challenge iframe still passes on Android (where isTopFrame is undefined and the iframe is routed through this handler); sub-frames remain unconditionally allowed on iOS via isTopFrame === false.
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesTurnstile WebView Navigation Gating
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…review) Address Codex/Greptile review on #3289: gating the top frame by bare https scheme is too loose. Because the ReactNativeWebView bridge + _onMessage accept a `verify` token from whatever page is loaded, a stray top-level navigation to an arbitrary https page could post a fake token. Pin the top document to the two hosts the widget actually loads -- our embed page (ecency.com) and Cloudflare's challenge (challenges.cloudflare.com). Sub-frames stay unconditionally allowed (iOS isTopFrame), and challenges.cloudflare.com is allow-listed explicitly so the challenge iframe still passes on Android, where isTopFrame is undefined.
1 participant
Follow-up to #3287 (iOS Turnstile fix — confirmed working on TestFlight).
Problem
#3287's top-frame guard gates the WebView's top document to our origin:
That works on iOS but breaks Turnstile on Android. Android's react-native-webview
shouldStartevent (createWebViewEvent,RNCWebViewClient.java) does not includeisTopFrame, so on Androidreq.isTopFrameis alwaysundefinedand the handler collapses to:Android routes iframe navigations through
shouldOverrideUrlLoadingtoo, so the Cloudflare challenge'shttps://challenges.cloudflare.com/...frame is evaluated by this handler — it doesn't start withecency.com, so it's cancelled and the challenge never completes.Fix
Gate by scheme instead of origin:
isTopFrame === false, top frame is our https embed page. (The real flow never navigates the top frame offecency.com, so dropping the origin check is a no-op for it.)file:/javascript:navigation (Greptile's defense-in-depth concern from fix(register): allow all WebView frame schemes so the Turnstile challenge completes on iOS #3287).Testing
chrome://inspectcan attach to the WebView on a dev build.Summary by CodeRabbit
https://ecency.com/andhttps://challenges.cloudflare.com/).