Customer issue: "Blocked a frame with origin <hostname> from accessing a cross-origin frame."

[ryan953]

Private ticket with customer info: https://getsentry.atlassian.net/browse/FEEDBACK-1689

The customer is getting this "Blocked a frame with origin from accessing a cross-origin frame" error which is preventing any replay from being captured.

[m-nathani]

The same issue is happening on my side as well

[Lms24]

I tried to reproduce this by adding an iframe to a small plain-JS test app of mine. I pointed it to various 3rd party websites and noticed that these "Blocked a frame" and a few other CSP errors only occur on some websites. So my guess is that this might be rather specific to certain websites that perhaps somehow test if they're used in an iframe?

@m-nathani could you elaborate a little on what's happening for you? For instance how you're using iFrames and how the error message looks for you. Also, does this error crash replays for you, too? Or is it just an error that's being logged to your console?

[Lms24]

@m-nathani I'm realizing, you already told me about your setup here, right? So I'm wondering if this is only an issue in situations where replay is used inside an iframe and not the base site.

[m-nathani]

@m-nathani I'm realizing, you already told me about your setup here, right? So I'm wondering if this is only an issue in situations where replay is used inside an iframe and not the base site.

@Lms24 it appears that the error i faced on the websites does not use replay inside an iframe.

This is exact error i faced using 7.28.1:
https://sentry.io/organizations/umai/issues/3808100150/?project=5264087&referrer=slack

Failed to read the 'contentDocument' property from 'HTMLIFrameElement':
 Blocked a frame with origin "https://letsumai.com" from accessing a cross-origin frame.

This is the site address which cause this error. Furthermore, you can check in the chrome dev tools Elements tab that the only iframe used in it for stripejs which we are using internally for payments.

Addiotnally, for the issue mentioned here, would appreciate if can help me resolve, as i am still facing it 🙏🏼

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[m-nathani]

The issue still happens, check here for details: https://sentry.io/organizations/umai/issues/3808100150/?project=5264087&referrer=slack

[Lms24]

I'm not sure if I'm missing some crucial information here but according to your description in #6542, your app is a modal that is embedded in your clients' websites. As we saw in #6542, the Replay integration interacts with your host website as it's accessing the base website's hub. So in this case, I can imagine that the browser detects a coss-origin frame access which could explain the error.

Something else I came across while checking your last linked error: There appear to be two script origins (https://letsumai.com vs widget.letsumai.com). Any chance that this is in fact responsible for the cross-origin access?