From 187111368a975a05b906e9bffc6a3275f4eaf8d9 Mon Sep 17 00:00:00 2001
From: Tobias Skarhed <1438972+tskarhed@users.noreply.github.com>
Date: Mon, 28 Oct 2024 11:48:44 +0100
Subject: [PATCH] Frontend Monitoring: Only write to custom Faro endpoint if
 origins are the same in iframe (#95381)

* Only enable Faro if origins are the same in iframe

* Handle non-iframe case

* Remove console logs

* Use try catch to identify cross origin iframe

* Only disable transport
---
 .../GrafanaJavascriptAgentBackend.ts                  | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/public/app/core/services/echo/backends/grafana-javascript-agent/GrafanaJavascriptAgentBackend.ts b/public/app/core/services/echo/backends/grafana-javascript-agent/GrafanaJavascriptAgentBackend.ts
index 65c821fbfd6..099ea2d4370 100644
--- a/public/app/core/services/echo/backends/grafana-javascript-agent/GrafanaJavascriptAgentBackend.ts
+++ b/public/app/core/services/echo/backends/grafana-javascript-agent/GrafanaJavascriptAgentBackend.ts
@@ -17,6 +17,14 @@ import { EchoBackend, EchoEvent, EchoEventType } from '@grafana/runtime';
 import { EchoSrvTransport } from './EchoSrvTransport';
 import { GrafanaJavascriptAgentEchoEvent, User } from './types';
 
+function isCrossOriginIframe() {
+  try {
+    return document.location.hostname !== window.parent.location.hostname;
+  } catch (e) {
+    return true;
+  }
+}
+
 export interface GrafanaJavascriptAgentBackendOptions extends BrowserConfig {
   buildInfo: BuildInfo;
   customEndpoint: string;
@@ -40,7 +48,8 @@ export class GrafanaJavascriptAgentBackend
 
     const transports: BaseTransport[] = [new EchoSrvTransport()];
 
-    if (options.customEndpoint) {
+    // If in cross origin iframe, default to writing to instance logging endpoint
+    if (options.customEndpoint && !isCrossOriginIframe()) {
       transports.push(new FetchTransport({ url: options.customEndpoint, apiKey: options.apiKey }));
     }