assign('iframeSrc', $src); // Expose just the app origin so the parent-side postMessage // listener can validate event.origin without leaking the secret. $this->assign('appOrigin', parse_url($appUrl, PHP_URL_SCHEME) . '://' . parse_url($appUrl, PHP_URL_HOST)); } $this->assign('configured', $configured); parent::run(); } }