Skip to main content

Security Considerations

Origin Validation

In production, always validate the origin of messages:

Content Security Policy

Add CSP headers to allow iframe embedding:

Input Validation

Validate wallet addresses before sending:

Best Practices

  1. Wait for Ready Signal: Always wait for IFRAME_READY before sending commands
  2. Queue Messages: Queue messages if iframe isn’t ready yet
  3. Validate Input: Validate wallet addresses before sending
  4. Handle Timeouts: Implement timeouts for async operations
  5. Error Handling: Always handle potential errors and edge cases
  6. Type Safety: Use TypeScript types for better development experience
  7. Security: Validate message origins in production

Troubleshooting

Common Issues