Riot Owned IFrame

<script>
  const localStorageKey = 'xsso_state';
  const minute = 60 * 1000;
  // Don't allow auth attempts more often than this
  const authTooSoon = (0.25 * minute);
  /**
   * @param {Object} item
   */
  function setState(item) {
    try {
      localStorage.setItem(localStorageKey, JSON.stringify(item));
    } catch (ex) {
      console.warn(`failed to parse ${item} as JSON and set to localStorage`, ex);
    }
  }
  /**
   * @returns Object
   */
  function getState() {
    try {
      return JSON.parse(localStorage.getItem(localStorageKey));
    } catch (ex) {
      console.warn(`failed to parse localStorage ${localStorageKey} as JSON`, ex);
      return null;
    }
  }
  /**
   * Returns true if it is too soon to try to auth again, on any site
   * @param {*} state
   * @returns {boolean}
   */
  function isTooSoon(state) {
    return typeof state === 'object' && state !== null && typeof state.next === 'number' && state.next > Date.now()
  }
  const isMessageForMe = (event) => getDomain(event.origin) === getDomain(location.origin) && typeof event.data === 'string';
  const getDomain = (url) => new URL(url).hostname.split('.').slice(-2).join('.')
  const minutesUntil = (ms) => Math.ceil((new Date(ms).getTime() - new Date().getTime()) / minute);
  /**
   *
   * @param {string} type
   * @param {string} [msg]
   * @param {string} [origin='*']
   */
  const emitMessage = (type, msg, origin) => {
    let str = `XSSO::${type}`;
    if (msg) {
      str += ' ' + msg;
    }
    window.parent.postMessage(str, origin || '*');
  }
  window.addEventListener('message', (event) => {
    if (!isMessageForMe(event)) {
      return emitMessage('invalid_origin', `expected ${getDomain(location.origin)} but received ${getDomain(event.origin)}`, event.origin);
    }
    const state = getState();
    if (isTooSoon(state)) {
      return emitMessage('too_soon', `too soon, wait ${minutesUntil(state.next)} minutes`, event.origin)
    }
    // remember not to check again until this time has passed; voluntary backoff
    setState({next: Date.now() + authTooSoon});

    //special case to attempt token refresh rather than full login if specified
    let href;
    if (event.data === 'refresh') {
      href = `${location.origin}/refresh`
      emitMessage('refresh', href);
    } else {
      href = `${location.origin}/login?${event.data}`
      emitMessage('login', href);
    }
    setTimeout(() => {
      location.href = href;
    }, 0)
  })
  window.addEventListener('error', (error) => {
    emitMessage('error', error.message);
  })
  // emit 'set' message for login calls if we came from the redirect url, (or origin, if they have a safe RefererPolicy)
  const origin = new URL(location.origin).toString();
  const redirectURL = new URL('/redirect', location.origin).toString();
  // emit 'set' message for refresh calls if we came from self
  const self = new URL('/riot-owned-iframe', location.origin).toString();
  if (document.referrer === '') {
    // referrer may be empty depending on the referer policy set by the parent page. If so, we can't tell if we came from a secure referrer, so warn and skip set.
    console.warn('Failed to detect referrer from xsso iframe');
  } else {
    const referrer = new URL(document.referrer).toString();
    if (referrer === origin || referrer === redirectURL || referrer === self) {
      emitMessage('set');
    }
  }

</script>