Iframe postmessage fraud

Question

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.

From what I was able to understand, the information is exchanged between the iframes using internal browser APIs, without any network communication. In other words, even if the two iframes exchanging information between them are hosted in two different servers originating from two different domains, I will not see any traffic being exchanged between these two servers when messages are posted. Before implementing this on my website, I just want to be sure - How does the browser validate the origin of the posted message? Is there any way an attacker can "spoof" a message and make it look like it originated from a legitimate iframe? I am guessing the answer is no because that would require reverse engineering the browser and exposing its internal APIs, but I just want to make sure that my understanding is correct.

Thanks in advance

Answer 1

If origin was spoofed in this context, this would be down to a flaw in the particular browser that had been exploited. There have been such flaws in the past, such as this one on Safari.

So assuming the user is using a fully patched browser and no zero day flaws exist (!) then your method of verifying the origin cannot be spoofed within the browser when receiving postMessage events.

At the end of the day you have to trust the browser is behaving as expected for it to hold up the client-side end of your security. Yes, a malicious user could cause their browser to spoof the origin, however if they cannot attack other users or your system itself by doing so and could only attack themselves you should be safe. Of course you should not use the origin value to verify things where a malicious user can gain advantage by spoofing it - you should only be using this value to verify that a user session is not being attacked, and not as a means of validating the user's actions. This is the same reason why you should not have client-side validation only for webforms as the user themselves can bypass it.

To summarise, in your scenario you should be able to trust the origin of the postMessage event.