appsmithorg/appsmith · error · TriggerFailureError

Please enter a target origin URL.

Error message

Please enter a target origin URL.

What it means

TriggerFailureError thrown by executePostMessage when the targetOrigin field on a postWindowMessage action is empty. The browser's window.postMessage requires an explicit target origin to prevent message leakage, so Appsmith refuses to send when none is supplied. This is a hard pre-flight validation, not a transport failure.

Source

Thrown at app/client/src/sagas/ActionExecution/PostMessageSaga.ts:22

  TriggerFailureError,
} from "sagas/ActionExecution/errorUtils";
import { isEmpty } from "lodash";
import type { TPostWindowMessageDescription } from "workers/Evaluation/fns/postWindowMessage";

export function* postMessageSaga(action: TPostWindowMessageDescription) {
  const { payload } = action;

  yield spawn(executePostMessage, payload);
}

export function* executePostMessage(
  payload: TPostWindowMessageDescription["payload"],
) {
  const { message, source, targetOrigin } = payload;

  try {
    if (isEmpty(targetOrigin)) {
      throw new TriggerFailureError("Please enter a target origin URL.");
    } else {
      if (source !== "window") {
        const src = document.getElementById(
          `iframe-${source}`,
        ) as HTMLIFrameElement;

        if (src && src.contentWindow) {
          src.contentWindow.postMessage(message, targetOrigin);
        } else {
          throw new TriggerFailureError(
            `Cannot find Iframe with name ${source} on this page`,
          );
        }
      } else {
        window.parent.postMessage(message, targetOrigin, undefined);
      }
    }
  } catch (error) {

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Open the action configuration and set targetOrigin to the exact origin (e.g. https://example.com) or '*' for development only.
2. If targetOrigin is bound, check the bound variable is defined and non-empty before the action fires.
3. Guard the call site in a JS object: only invoke postWindowMessage when targetOrigin is truthy.

Example fix

// before
postWindowMessage({ message: 'hi', source: 'window', targetOrigin: '' });
// after
postWindowMessage({ message: 'hi', source: 'window', targetOrigin: 'https://example.com' });

const targetOrigin = (appsmith.store.targetOrigin ?? '').trim();
if (!targetOrigin) {
  showAlert('targetOrigin is required', 'error');
  return;
}
postWindowMessage({ message, source: 'window', targetOrigin });

function isValidTargetOrigin(v: unknown): v is string {
  return typeof v === 'string' && v.trim().length > 0;
}

try {
  postWindowMessage({ message, source: 'window', targetOrigin });
} catch (e) {
  if (e instanceof TriggerFailureError) showAlert(e.message, 'error');
}

When it happens

Trigger: A postWindowMessage action is configured with a blank targetOrigin, or the targetOrigin binding resolves to undefined/null/empty string at runtime (e.g. {{ appsmith.URL }} when the store field isn't populated).

Common situations: Developer forgets to fill the targetOrigin field; binding references a store/widget property that has not been initialised yet; copying an action between pages and leaving the field empty.

Related errors

• The ${path} path must start with 'https://'.
• Cannot find Iframe with name ${source} on this page
• PE-DSE-5003
• error
• resetWidget expected STRING for 'widgetName' argument but re

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/db78496e19961897. Report an issue: GitHub.