Browser & Web Performance · Middle · Question 59 of 75

What must a `message` event handler check before trusting `event.data`?

window.addEventListener("message", (event) => {
  // ...
});

1event.data is a string
2The message arrived within 1 second
✓Correct answer: event.origin is in the list of expected origins

Explanation

Any window can post messages to yours. When sending, set the exact targetOrigin instead of * too.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.