Tag Info

New answers tagged


No - window.postMessage triggers a JavaScript event, not a HTTP request. The target window needs to be listening for the message. As noted on MDN: If you do not expect to receive messages from other sites, do not add any event listeners for message events. This is a completely foolproof way to avoid security problems. If you do expect to ...


One iframe does a GET on the page with the password and sends this password via html5 windows.postMessage() to another iframe (sourcing the attacker's site) which takes this password and sends it off to the hacker's site via a query parameter in an http get to a hacker's web service. postMessage is done with Javascript. This means one can not force a ...

Top 50 recent answers are included