{"record":{"id":"db78496e19961897","repo":"appsmithorg/appsmith","slug":"please-enter-a-target-origin-url","errorCode":null,"errorMessage":"Please enter a target origin URL.","messagePattern":"Please enter a target origin URL\\.","errorType":"validation","errorClass":"TriggerFailureError","httpStatus":null,"severity":"error","filePath":"app/client/src/sagas/ActionExecution/PostMessageSaga.ts","lineNumber":22,"sourceCode":"  TriggerFailureError,\n} from \"sagas/ActionExecution/errorUtils\";\nimport { isEmpty } from \"lodash\";\nimport type { TPostWindowMessageDescription } from \"workers/Evaluation/fns/postWindowMessage\";\n\nexport function* postMessageSaga(action: TPostWindowMessageDescription) {\n  const { payload } = action;\n\n  yield spawn(executePostMessage, payload);\n}\n\nexport function* executePostMessage(\n  payload: TPostWindowMessageDescription[\"payload\"],\n) {\n  const { message, source, targetOrigin } = payload;\n\n  try {\n    if (isEmpty(targetOrigin)) {\n      throw new TriggerFailureError(\"Please enter a target origin URL.\");\n    } else {\n      if (source !== \"window\") {\n        const src = document.getElementById(\n          `iframe-${source}`,\n        ) as HTMLIFrameElement;\n\n        if (src && src.contentWindow) {\n          src.contentWindow.postMessage(message, targetOrigin);\n        } else {\n          throw new TriggerFailureError(\n            `Cannot find Iframe with name ${source} on this page`,\n          );\n        }\n      } else {\n        window.parent.postMessage(message, targetOrigin, undefined);\n      }\n    }\n  } catch (error) {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/appsmithorg/appsmith/blob/8cd9021c24cdbea1c3c12c966073708e83db60c2/app/client/src/sagas/ActionExecution/PostMessageSaga.ts#L4-L40","documentation":"TriggerFailureError thrown by executePostMessage when the targetOrigin field on a postWindowMessage action is empty. The browser's window.postMessage requires an explicit target origin to prevent message leakage, so Appsmith refuses to send when none is supplied. This is a hard pre-flight validation, not a transport failure.","triggerScenarios":"A postWindowMessage action is configured with a blank targetOrigin, or the targetOrigin binding resolves to undefined/null/empty string at runtime (e.g. {{ appsmith.URL }} when the store field isn't populated).","commonSituations":"Developer forgets to fill the targetOrigin field; binding references a store/widget property that has not been initialised yet; copying an action between pages and leaving the field empty.","solutions":["Open the action configuration and set targetOrigin to the exact origin (e.g. https://example.com) or '*' for development only.","If targetOrigin is bound, check the bound variable is defined and non-empty before the action fires.","Guard the call site in a JS object: only invoke postWindowMessage when targetOrigin is truthy."],"exampleFix":"// before\npostWindowMessage({ message: 'hi', source: 'window', targetOrigin: '' });\n// after\npostWindowMessage({ message: 'hi', source: 'window', targetOrigin: 'https://example.com' });","handlingStrategy":"validation","validationCode":"const targetOrigin = (appsmith.store.targetOrigin ?? '').trim();\nif (!targetOrigin) {\n  showAlert('targetOrigin is required', 'error');\n  return;\n}\npostWindowMessage({ message, source: 'window', targetOrigin });","typeGuard":"function isValidTargetOrigin(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0;\n}","tryCatchPattern":"try {\n  postWindowMessage({ message, source: 'window', targetOrigin });\n} catch (e) {\n  if (e instanceof TriggerFailureError) showAlert(e.message, 'error');\n}","preventionTips":["Treat targetOrigin as a required field in your action config.","Avoid '*' in production; pin the exact origin.","Bind targetOrigin to a non-empty appsmith store value you control."],"tags":["postmessage","validation","iframe","security"],"backgroundTag":null,"analyzedSha":"8cd9021c24cdbea1c3c12c966073708e83db60c2","analyzedAt":"2026-08-12T22:14:19.293Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}