fix(embed): use document.referrer origin for host_application by Yeboahmedia · Pull Request #648 · smileidentity/web-client

Kwame Yeboah (Yeboahmedia) · 2026-06-05T13:43:31Z

User description

Problem

The host_application metadata field always reports https://cdn.smileidentity.com for hosted embed traffic, because window.location inside the iframe is the CDN host, not the partner site that loaded us.

Fix

Use `document.referrer` (parsed via `URL` to keep just the origin) as the source for `host_application`, falling back to the iframe's own origin when the referrer is empty (parent set `Referrer-Policy: no-referrer`, privacy extensions, direct loads in dev).

Under the modern browser default (`strict-origin-when-cross-origin`), `document.referrer` already gives us the origin only — exactly what we want for this telemetry field — so partners don't need to change anything for this to start working.

Coverage expectation

~95–99% of loads: real partner origin (e.g. `https://partner.com\`)
~1–5%: falls back to self-origin (referrer suppressed by parent policy or extensions)

Notes

Origin-only by design: we wrap with `new URL(referrer).origin` so even if a partner ships an unsafe-url policy we don't accidentally start storing paths/queries in metadata.
Captured once at `initializeMetadata` time (existing behaviour), so in-iframe navigation can't overwrite it with a stale value.

PR Type

Bug fix

Description

Use document.referrer origin for host_application metadata
Fixes iframe always reporting CDN host instead of partner site
Falls back to self-origin when referrer is unavailable
Strips paths/queries via new URL().origin for privacy

Diagram Walkthrough

flowchart LR
  A["document.referrer"] -- "available" --> B["new URL(referrer).origin"]
  A -- "empty/invalid" --> C["self-origin fallback"]
  B --> D["host_application metadata"]
  C --> D

File Walkthrough

Relevant files

Bug fix

index.js `Derive host_application from document.referrer origin` packages/embed/src/js/metadata/index.js Added `getHostApplication()` helper function that reads `document.referrer` and extracts the origin Falls back to `window.location` protocol+hostname when referrer is empty or URL parsing fails Replaced inline `hostApplication` assignment in `initializeMetadata` with call to `getHostApplication()`	+16/-2

Documentation

CHANGELOG.md `Add changelog entry for host_application fix` CHANGELOG.md Added changelog entry under [Unreleased] describing the `host_application` metadata source change	+4/-0

Need help?
Type /help how to ... in the comments thread for any questions about PR-Agent usage.
Check out the documentation for more information.

The host_application metadata field was always reporting the iframe's own host (cdn.smileidentity.com) because window.location inside the embed iframe is the CDN, not the partner site. Use document.referrer to capture the parent page origin instead, falling back to self-origin when referrer is empty (e.g. parent sets Referrer-Policy: no-referrer).

prfectionist · 2026-06-05T13:44:02Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
🏅 Score: 92
🧪 No relevant tests
🔒 Security concerns No. The `document.referrer` value is used only for telemetry metadata, and the code explicitly strips paths/queries via `new URL().origin`. While `document.referrer` can be influenced by the parent page, this is acceptable for analytics purposes and no sensitive data is exposed.
🔀 No multiple PR themes
⚡ Recommended focus areas for review Referrer Spoofing `document.referrer` can be spoofed by the embedding page (e.g., via meta tags or header manipulation). If `host_application` is used for any access-control, billing, or trust decisions downstream, this could be a concern. Verify that this field is used purely for telemetry/analytics and not for authorization purposes. if (document.referrer) { try { return new URL(document.referrer).origin; } catch { // fall through to self-origin fallback } }

github-actions · 2026-06-05T13:44:08Z

🔍 Semgrep Security Scan Results

✅ No security findings detected by p/security-audit ruleset.

prfectionist · 2026-06-05T13:44:09Z

PR Code Suggestions ✨

No code suggestions found for the PR.

Copilot

Pull request overview

This PR fixes embed telemetry so host_application reflects the parent page’s origin (the site embedding the iframe) instead of always reporting the iframe/CDN origin.

Changes:

Add a getHostApplication() helper that derives host_application from document.referrer (origin-only) with a fallback when referrer is unavailable.
Update initializeMetadata() to use the new helper for host_application.
Document the behavior change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/embed/src/js/metadata/index.js	Switch `host_application` derivation from iframe location to referrer origin via a helper.
CHANGELOG.md	Add an Unreleased entry describing the `host_application` source change for embed.

+  if (document.referrer) {
+    try {
+      return new URL(document.referrer).origin;
+    } catch {
+      // fall through to self-origin fallback
+    }
+  }
+  return `${window.location.protocol}//${window.location.hostname}`;


 export const initializeMetadata = async () => {
  metadata = [];
-  const hostApplication = `${window.location.protocol}//${window.location.hostname}`;
-  addMetadataEntry('host_application', hostApplication);
+  addMetadataEntry('host_application', getHostApplication());



github-actions · 2026-06-05T14:12:59Z

This branch has been deployed to s3 / cloudfront.

✅ Preview URL for Smart Camera Web:

https://cdn.smileidentity.com/js/preview-referer-host-application/smart-camera-web.js

✅ Preview URL for Embed:

https://cdn.smileidentity.com/inline/preview-referer-host-application/js/script.min.js

✅ Preview URL for Web Client (Sandbox):

https://d2l9sy466fppw.cloudfront.net

✅ Preview URL for Web Client (Production):

https://d3skarw1cepbu8.cloudfront.net

Use window.location.origin for the fallback (matches the URL().origin format used in the referrer branch — includes port if non-default) and ignore the "null" serialization for opaque origins (about:blank, sandboxed iframes, data: URLs).

github-actions · 2026-06-22T18:01:28Z

This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 7 days.

Kwame Yeboah (Yeboahmedia) · 2026-06-24T13:03:13Z

Copilot resolve the merge conflicts in this pull request

Copilot · 2026-06-24T13:06:03Z

Copilot resolve the merge conflicts in this pull request

Merge conflicts are resolved in commit 6286602.

Copilot AI review requested due to automatic review settings June 5, 2026 13:43

github-actions Bot assigned Kwame Yeboah (Yeboahmedia) Jun 5, 2026

Copilot started reviewing on behalf of Kwame Yeboah (Yeboahmedia) June 5, 2026 13:43 View session

prfectionist Bot added the Review effort 1/5 label Jun 5, 2026

Copilot AI reviewed Jun 5, 2026

View reviewed changes

Merge branch 'main' into referer-host-application

08f0a06

Kwame Yeboah (Yeboahmedia) and others added 2 commits June 5, 2026 15:26

Merge branch 'main' into referer-host-application

04f971b

github-actions Bot added the Stale label Jun 22, 2026

Copilot started work on behalf of Kwame Yeboah (Yeboahmedia) June 24, 2026 13:03 View session

Merge branch 'main' into referer-host-application

6286602

Copilot finished work on behalf of Kwame Yeboah (Yeboahmedia) June 24, 2026 13:06

Kwame Yeboah (Yeboahmedia) marked this pull request as draft June 24, 2026 13:06

github-actions Bot removed the Stale label Jun 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(embed): use document.referrer origin for host_application#648

fix(embed): use document.referrer origin for host_application#648
Kwame Yeboah (Yeboahmedia) wants to merge 5 commits into
mainfrom
referer-host-application

Kwame Yeboah (Yeboahmedia) commented Jun 5, 2026 •

edited by prfectionist Bot

Loading

Uh oh!

prfectionist Bot commented Jun 5, 2026

Uh oh!

github-actions Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

prfectionist Bot commented Jun 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Kwame Yeboah (Yeboahmedia) commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Kwame Yeboah (Yeboahmedia) commented Jun 5, 2026 • edited by prfectionist Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Problem

Fix

Coverage expectation

Notes

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

prfectionist Bot commented Jun 5, 2026

PR Reviewer Guide 🔍

Uh oh!

github-actions Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Semgrep Security Scan Results

Uh oh!

prfectionist Bot commented Jun 5, 2026

PR Code Suggestions ✨

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Kwame Yeboah (Yeboahmedia) commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Kwame Yeboah (Yeboahmedia) commented Jun 5, 2026 •

edited by prfectionist Bot

Loading

github-actions Bot commented Jun 5, 2026 •

edited

Loading

github-actions Bot commented Jun 5, 2026 •

edited

Loading