JavaScript · Senior · Question 16 of 75
What must you check in a message handler when talking to an iframe via postMessage?
- ✓Correct answer:
event.origin- that the message came from the expected domain - 2
event.timeStamp- that the message is no older than one second - 3Nothing: the browser delivers messages only from your domain
Explanation
postMessage works across origins, and any window can send a message. Without checking origin, an attacker can send forged commands. When sending, specify a concrete targetOrigin instead of '*'. Between tabs of the same site, BroadcastChannel is handy.