Skip to content

docs(browser-keys): note sandboxed-iframe (Origin: null) limitation #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mikedotexe merged 1 commit into from
Jun 24, 2026
Merged

docs(browser-keys): note sandboxed-iframe (Origin: null) limitation #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/auth/browser-keys.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,12 @@ restricted browser key, served from a domain you listed on the key.
Use two keys: a restricted browser key for the frontend, and an unrestricted server key for the backend.
Do not try to share one key across both.

### My key fails from inside an embedded or sandboxed iframe

A sandboxed `<iframe>` sends `Origin: null` and usually omits `Referer`, so a website-restricted key
returns `403 origin_not_allowed` even on your own domain. A widget in a sandboxed iframe can't use a
restricted browser key — call FastNear from the top-level page, or route through a server-side path.

## Related guides

- [Auth & Access](/auth) — the server-key default and transport choices
Expand Down
4 changes: 4 additions & 0 deletions i18n/ru/docusaurus-plugin-content-docs/current/auth/browser-keys.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,10 @@ const res = await fetch(`https://rpc.mainnet.fastnear.com?apiKey=${FASTNEAR_API_

Используйте два ключа: браузерный ключ с ограничением для фронтенда и серверный ключ без ограничений для бэкенда. Не пытайтесь использовать один ключ для обоих случаев.

### Ключ не работает из встроенного или изолированного iframe

Изолированный `<iframe>` отправляет `Origin: null` и обычно не передаёт `Referer`, поэтому ключ с ограничением по сайтам возвращает `403 origin_not_allowed` даже на собственном домене. Виджет в изолированном iframe не может использовать браузерный ключ с ограничением — вызывайте FastNear со страницы верхнего уровня или используйте серверный путь.

## Связанные руководства

- [Аутентификация и доступ](/auth) — серверный ключ по умолчанию и выбор способа передачи
Expand Down
Loading