diff --git a/src/FromWidgetPostMessageApi.js b/src/FromWidgetPostMessageApi.js
index f41cf0543d..00e5588ec0 100644
--- a/src/FromWidgetPostMessageApi.js
+++ b/src/FromWidgetPostMessageApi.js
@@ -259,6 +259,7 @@ export default class FromWidgetPostMessageApi {
     sendResponse(event, res) {
         const data = objectClone(event.data);
         data.response = res;
+        if (!event.source) return; // source may have gone away since
         event.source.postMessage(data, event.origin);
     }
 
diff --git a/src/components/views/dialogs/ModalWidgetDialog.tsx b/src/components/views/dialogs/ModalWidgetDialog.tsx
index f17b1ec27a..60f5a09666 100644
--- a/src/components/views/dialogs/ModalWidgetDialog.tsx
+++ b/src/components/views/dialogs/ModalWidgetDialog.tsx
@@ -83,9 +83,11 @@ export default class ModalWidgetDialog extends React.PureComponent<IProps, IStat
     public render() {
         // TODO: Don't violate every single security principle
 
-        const widgetId = encodeURIComponent(this.getWidgetId());
-        const parentUrl = encodeURIComponent(window.location.href);
-        const widgetUrl = `${this.props.widgetDefinition.url}?widgetId=${widgetId}&parentUrl=${parentUrl}`;
+        const widgetUrl = new URL(this.props.widgetDefinition.url);
+        // TODO: Replace these with proper widget params
+        // See https://github.com/matrix-org/matrix-doc/pull/1958/files#r405714833
+        widgetUrl.searchParams.set("widgetId", this.getWidgetId());
+        widgetUrl.searchParams.set("parentUrl", window.location.href);
 
         let buttons;
         if (this.props.widgetDefinition.buttons) {
@@ -124,10 +126,10 @@ export default class ModalWidgetDialog extends React.PureComponent<IProps, IStat
             <div>
                 <iframe
                     ref={this.appFrame}
-                    sandbox="allow-forms allow-scripts"
+                    // sandbox="allow-forms allow-scripts"
                     width={700} // TODO
                     height={450} // TODO
-                    src={widgetUrl}
+                    src={widgetUrl.toString()}
                     onLoad={this.onLoad}
                 />
             </div>
diff --git a/src/widgets/WidgetApi.ts b/src/widgets/WidgetApi.ts
index 02ec2f4166..6ce4f0e47d 100644
--- a/src/widgets/WidgetApi.ts
+++ b/src/widgets/WidgetApi.ts
@@ -126,44 +126,47 @@ export class WidgetApi extends EventEmitter {
             if (payload.api === WidgetApiType.ToWidget && payload.action) {
                 console.log(`[WidgetAPI] Got request: ${JSON.stringify(payload)}`);
 
-                if (payload.action === KnownWidgetActions.GetCapabilities) {
-                    this.onCapabilitiesRequest(<ToWidgetRequest>payload);
-                    if (!this.expectingExplicitReady) {
-                        this.readyPromiseResolve();
-                    }
-                } else if (payload.action === KnownWidgetActions.ClientReady) {
-                    this.readyPromiseResolve();
+                switch (payload.action) {
+                    case KnownWidgetActions.GetCapabilities:
+                        this.onCapabilitiesRequest(<ToWidgetRequest>payload);
+                        if (!this.expectingExplicitReady) {
+                            this.readyPromiseResolve();
+                        }
+                        break;
 
-                    // Automatically acknowledge so we can move on
-                    this.replyToRequest(<ToWidgetRequest>payload, {});
-                } else if (payload.action === KnownWidgetActions.Terminate) {
-                    // Finalization needs to be async, so postpone with a promise
-                    let finalizePromise = Promise.resolve();
-                    const wait = (promise) => {
-                        finalizePromise = finalizePromise.then(() => promise);
-                    };
-                    this.emit('terminate', wait);
-                    Promise.resolve(finalizePromise).then(() => {
-                        // Acknowledge that we're shut down now
+                    case KnownWidgetActions.ClientReady:
+                        this.readyPromiseResolve();
+
+                        // Automatically acknowledge so we can move on
                         this.replyToRequest(<ToWidgetRequest>payload, {});
-                    });
-                } else if (payload.action === KnownWidgetActions.ReceiveOpenIDCredentials) {
-                    // Save OpenID credentials
-                    this.setOpenIDCredentials(<ToWidgetRequest>payload);
-                    this.replyToRequest(<ToWidgetRequest>payload, {});
-                } else if (payload.action === KnownWidgetActions.GetWidgetConfig) {
-                    // Finalization needs to be async, so postpone with a promise
-                    let finalizePromise = Promise.resolve();
-                    const wait = (promise) => {
-                        finalizePromise = finalizePromise.then(() => promise);
-                    };
-                    this.emit(payload.action, payload, wait);
-                    Promise.resolve(finalizePromise).then(() => {
-                        // Acknowledge that we're shut down now
+                        break;
+
+                    case KnownWidgetActions.ReceiveOpenIDCredentials:
+                        // Save OpenID credentials
+                        this.setOpenIDCredentials(<ToWidgetRequest>payload);
                         this.replyToRequest(<ToWidgetRequest>payload, {});
-                    });
-                } else {
-                    console.warn(`[WidgetAPI] Got unexpected action: ${payload.action}`);
+                        break;
+
+                    // Ack, handle by caller
+                    case KnownWidgetActions.Terminate:
+                    case KnownWidgetActions.ButtonClicked:
+                    case KnownWidgetActions.GetWidgetConfig:
+                    case KnownWidgetActions.CloseModalWidget: {
+                        // Finalization needs to be async, so postpone with a promise
+                        let finalizePromise = Promise.resolve();
+                        const wait = (promise) => {
+                            finalizePromise = finalizePromise.then(() => promise);
+                        };
+                        this.emit(payload.action, payload, wait);
+                        Promise.resolve(finalizePromise).then(() => {
+                            // Acknowledge that we're shut down now
+                            this.replyToRequest(<ToWidgetRequest>payload, {});
+                        });
+                        break;
+                    }
+
+                    default:
+                        console.warn(`[WidgetAPI] Got unexpected action: ${payload.action}`);
                 }
             } else if (payload.api === WidgetApiType.FromWidget && this.inFlightRequests[payload.requestId]) {
                 console.log(`[WidgetAPI] Got reply: ${JSON.stringify(payload)}`);