MetaMask / MetaMask/metamask-extension
MetaMask says not connected when the instance which has connected is within an iframe + does not show reconnect logic when changing account
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Hey!
If you call `eth_requestAccounts` within an iframe of the website MetaMask connects, lets you sign, etc, and all the functionality works but then will say not connected on the browser extension and never bring up the UI to reconnect if you switch accounts. It thinks the parent domain is the thing trying to requested access to it which is incorrect it's actually an iframe within the parent website which has access to it.

Our wallet is integrated using iframes and we want to integrate the ability to use MM on it. But without this logic, we can not go any further as the UX/UI will just end up being impossible to maintain (due to not being able to reconnect or your UI showing)
A simple way to recreate:
- (app 1) - create a simple app which is the main page
- (app 2) - create another app that on page load calls `await window.ethereum.request({ method: 'eth_requestAccounts' })`
- iframe app 2 into into app 1
- refresh and connect an account
- now look at your connected sites for that account (it will say not connected using the parents domain) and try to change accounts to toggle the reconnect logic (it will not show as it doesn't think your connected to anything)
I personally think the solution should be making sure you look at all iframes embedded into the website as well as the main domain this way you can tell if connected site x is actually in the website meaning you can allow it to work within iframes.
I understand on some edge cases where an iframe may use it but the main domain does as well in those cases I expect you to use the main domain.
Contributor guide
Research direction
Start by reproducing the issue with an app that calls window.ethereum.request({ method: 'eth_requestAccounts' }) inside an iframe, embedded in a parent app. Inspect connected-site tracking and account-change reconnect handling; the payload names no files or tests. Done means the iframe's connection is represented correctly, the reconnect UI appears after switching accounts, and parent-domain precedence works when both domains are connected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100