Replay causes error `Blocked a frame with origin <hostname> from accessing a frame with origin "https://js.stripe.com"` in Safari when Stripe payment form is on the page

[jakst]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

8.22.0

Framework Version

No response

Link to Sentry event

No response

Reproduction Example/SDK Setup

Sentry.init({
  dsn: "https://examplePublicKey@o0.ingest.sentry.io/0",
  replaysSessionSampleRate: 1,
  integrations: [
    Sentry.replayIntegration({
      block: ["iframe"],
    }),
  ],
})

Steps to Reproduce

A minimal reproduction repro with a deployed example is available at https://github.com/jakst/sentry-replay-stripe. Basically running the Sentry Replay integration when a Stripe form is rendered causes this error Blocked a frame with origin "https://sentry-replay-stripe.vercel.app" from accessing a frame with origin "https://js.stripe.com".

I was following along in #6560 and though the issue was resolved, but even though I have confirmed the claimed fix is present in our version of the SDK, we still get this error with the stripe form together with Sentry Replay.

Expected Result

I would expect that setting block: ["iframe"] allows us to render the Stripe payments form without getting any errors.

Actual Result

This error is written in the console on Safari

Blocked a frame with origin "https://sentry-replay-stripe.vercel.app" from accessing a frame with origin "https://js.stripe.com". Protocols, domains, and ports must match.

[billyvg]

Ah, it's likely that we don't check the block attribute when an iframe gets added to the DOM after the snapshot.

[jakst]

Ah, it's likely that we don't check the block attribute when an iframe gets added to the DOM after the snapshot.

Yeah that sounds like it could be it!

[andreiborza]

@billyvg I've assigned this to you. Let me know if there's something we can help with.