cosmology-tech / cosmos-kit

Universal wallet connector for the Cosmos ⚛️
https://cosmology.zone/products/cosmos-kit
BSD 3-Clause Clear License
183 stars 129 forks source link

Use the latest Cosmiframe version with security features #431

Closed NoahSaso closed 4 months ago

NoahSaso commented 4 months ago

Cosmiframe previously lacked origin restrictions that meant any parent window could control the app, potentially allowing for MITM attacks.

This updates it to the latest version which requires strict origin filters.

By default this will allow Osmosis and DAO DAO to control Cosmos Kit apps. disableIframe is replaced with allowedIframeParentOrigins in the provider, which can be set to an empty array if someone wants to disable it completely.