The posthog-js library is throwing error, when user is iddle

[lukasbicus]

Bug description

Our Sentry reported over 170 errors during the last month, with this error thrown:

SecurityError: Failed to read a named property 'removeEventListener' from 'Window': Blocked a frame with origin "https://app.tradespace.io" from accessing a cross-origin frame.
    at h (../../../node_modules/.pnpm/@rrweb+record@2.0.0-alpha.17_patch_hash=4a974d451d029e3ef6c302f641dfaf41fb0881146b6d5198ccdbe8d50776b64f/node_modules/@rrweb/record/dist/record.js:3615:1)
    at forEach (../../../node_modules/.pnpm/@rrweb+record@2.0.0-alpha.17_patch_hash=4a974d451d029e3ef6c302f641dfaf41fb0881146b6d5198ccdbe8d50776b64f/node_modules/@rrweb/record/dist/record.js:5571:27)
    at Array.forEach (<anonymous>)
    at call (../../../node_modules/.pnpm/@rrweb+record@2.0.0-alpha.17_patch_hash=4a974d451d029e3ef6c302f641dfaf41fb0881146b6d5198ccdbe8d50776b64f/node_modules/@rrweb/record/dist/record.js:5571:14)
    at LazyLoadedSessionRecording.stop (../src/extensions/replay/external/lazy-loaded-session-recorder.ts:791:9)
    at this._onSessionIdleResetForcedListener (../src/extensions/replay/external/lazy-loaded-session-recorder.ts:704:22)
    at SimpleEventEmitter.emit (../../../node_modules/posthog-js/src/utils/simple-event-emitter.ts:21:13)
    at this._enforceIdleTimeout (../../../node_modules/posthog-js/src/sessionid.ts:329:36)
    at sentryWrapped (../../../node_modules/@sentry/browser/src/helpers.ts:117:17)

Please describe.

How to reproduce

1. The users were idle for a long period of time

Related sub-libraries

• All of them
• posthog-js (web)
• posthog-js-lite (web lite)
• posthog-node
• posthog-react-native
• @posthog/react
• @posthog/ai
• @posthog/nextjs-config

Additional context

The bug seems to happen to me, originating in the @rrweb/record@2.0.0-alpha.17 / using the @rrweb/record@2.0.0-alpha.17 in Posthog.

Updating to @rrweb/record@2.0.0-alpha.18 may help.

Any advice, how can this be fixed in our repository?

[lukasbicus]

I noticed, we still use PostHogProvider from posthog-js/react. Is this package deprecated? Should we use @posthog/react?

[marandaneto]

@PostHog/team-replay probably a replay issue since i see 'rrweb' logs

[pauldambra]

hey @lukasbicus can you share a little more about how you're using posthog replay - since there's an iframe cross origin issue here... this is our tidy-up code running, i guess there's an assumption about the context it's running in that isn't true for your setup

I noticed, we still use PostHogProvider from posthog-js/react. Is this package deprecated? Should we use @posthog/react?

i don't think that will help here, but yep you should move over at some point - although posthog-js/react is just a passthrough to @posthog/react so it won't change anything except tidiness

[lukasbicus]

Hi @pauldambra - thanks for taking a look.

Here is what I found when I investigated the setup on our project:

// We init PostHog like this:
posthog.init(process.env.POST_HOG_API_KEY, {
  api_host: process.env.POST_HOG_HOST,
  defaults: '2025-05-24',
  disable_session_recording: currentUser?.tradespaceEmployee ? true : false,
  session_recording: {
    recordCrossOriginIframes: false
  }
});

if (currentUser) {
  posthog.identify(currentUser.uuid, {
    email: currentUser.email,
    name: currentUser.fullName,
    account_id: currentAccount.id,
    account_user_id: currentAccountUser.id
  });
}

import posthog from 'posthog-js';
// We wrap the app in the PostHogProvider:
// ...
  <PostHogProvider client={posthog}>
    {
      //... the app itself.
    }
  </PostHogProvider>

We also use some feature flags on our project (useFeatureFlagEnabled from posthog-js/react).

Is this helpful? I'm not quite sure, how to answer this question. I watch videos of users' behavior only on Sentry.

[pauldambra]

Does your application run in an iframe?

When a user is idle for a long time and posthog recording is running we shut down the recorder to save resources and the error message looks like for some reason we can create the event listeners but when we are tearing down we get an error removing them 🫠

[lukasbicus]

No, our application doesn't run in an iframe.

[pauldambra]

Hmmm, surprising the error has Blocked a frame with origin "https://app.tradespace.io/" from accessing a cross-origin frame.

something is in a frame 🙈

[lukasbicus]

Hmmm, surprising the error has Blocked a frame with origin "https://app.tradespace.io/" from accessing a cross-origin frame.

something is in a frame 🙈

Ouu, that can be a clue. Our app runs on https://app.tradespacestaging.io/ or https://app.tradespace.io/. Usually, people use it from the browser. If it is used in an iframe, it has to be a very specific kind of usage. I'll discuss with my team and let you know with further findings.

[pauldambra]

awesome, thank you!
very happy to ship a fix here but don't know what it would be 🙈 😅

[lukasbicus]

Hi @pauldambra - We get your point. Of course, this package can't resolve our CORS issues.

Right now, we don't understand where the root of the issue is, as we don't use our app in an iframe 99 percent of the time, and the error happens on pages distant from this iframe. We will watch this issue further. Thanks for your insights.

[pauldambra]

No worries, thanks for you patience with the back-and-forth here

Do let us know how it goes, since even if it's not something we could fix (and ofc it might still be) we might be able to output a nicer error that makes this easier for the future traveller!

[filipgymdesk]

I was also able to reproduce this one on my local, by just idling for a longer period of time ~30 mins on the screen where the posthog is called. No iframe here as well

record.js:3615 Uncaught SecurityError: Failed to read a named property 'removeEventListener' from 'Window': Blocked a frame with origin "https://localhost.test" from accessing a cross-origin frame.
at Ie.stop (lazy-loaded-session-recorder.ts:876:9)
at lazy-loaded-session-recorder.ts:753:22
at Cn.emit (simple-event-emitter.ts:21:13)
at sessionid.ts:330:36

using the php sdk, probably after reply inactivity it tries to do a cleanup?

Seems to fail on
this._stopRrweb?.()