Skip to content
uencoder

postMessage

postMessage is the cross-origin window messaging API: the sender specifies the target origin and the receiver validates the source origin, passing messages securely across origins.

Purpose

To communicate securely across cross-origin iframes/popups, replacing unreliable cross-origin DOM access.

Mechanism

sender.postMessage(data, targetOrigin): targetOrigin restricts the receiving origin. The receiver message event carries origin and source; it should verify the origin matches expectations before processing.

Use cases

  • Cross-origin iframe communication
  • Popup communication
  • Cross-domain messaging

Related tools

References