From 01b2ea77818a11410f4cb23a60382f4d027ac1ad Mon Sep 17 00:00:00 2001 From: Guillaume Lebedel Date: Thu, 5 Mar 2026 18:54:52 +0000 Subject: [PATCH] fix: handle COOP policy blocking OAuth popup window.close() When the OAuth redirect page (e.g. app.stackone.com/embedded/accounts/callback) sets Cross-Origin-Opener-Policy: same-origin, the opener page loses the ability to call .close() on the popup window reference. This caused a browser error: 'Cross-Origin-Opener-Policy policy would block the window.close call.' The Hub's state was already updated correctly before the close() attempt, so wrapping the call in try/catch is sufficient: the popup will close itself via window.close() on the callback page, or the user can close it manually. Fixes both processMessageCallback and handleOAuthResultFromAnyChannel. --- .../hooks/useIntegrationPicker.ts | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/modules/integration-picker/hooks/useIntegrationPicker.ts b/src/modules/integration-picker/hooks/useIntegrationPicker.ts index b92738f..fd2285b 100644 --- a/src/modules/integration-picker/hooks/useIntegrationPicker.ts +++ b/src/modules/integration-picker/hooks/useIntegrationPicker.ts @@ -117,7 +117,14 @@ export const useIntegrationPicker = ({ } if (connectWindow.current) { - connectWindow.current.close(); + try { + // COOP (Cross-Origin-Opener-Policy) on the OAuth redirect page may block + // this call. Catch silently — the popup will close itself or the user can + // close it manually; our state is already updated correctly. + connectWindow.current.close(); + } catch { + // intentionally ignored + } connectWindow.current = null; } @@ -150,7 +157,14 @@ export const useIntegrationPicker = ({ } if (connectWindow.current) { - connectWindow.current.close(); + try { + // COOP (Cross-Origin-Opener-Policy) on the OAuth redirect page may block + // this call. Catch silently — the popup will close itself or the user can + // close it manually; our state is already updated correctly. + connectWindow.current.close(); + } catch { + // intentionally ignored + } connectWindow.current = null; } },