Web Security · Middle · Question 75 of 75

What must a `message` event handler for `postMessage` check?

window.addEventListener('message', (e) => {
  applySettings(e.data);
});

✓Correct answer: That e.origin is an expected origin, and that e.data has the expected shape
2Only that e.data is not empty
3Nothing, postMessage only works within the same origin

Explanation

Any window that holds a reference to yours can post messages. Without an origin check, another site can feed data into applySettings.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.