postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication.

What do I need to do to use postMessage securely? What are the primary security pitfalls or mistakes that I need to look out for?


1 Answer 1


The W3C security instructions for this are surprisingly accurate and complete:

Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, bugs in the author's message handling code could be exploited by hostile sites.

Furthermore, even after checking the origin attribute, authors should also check that the data in question is of the expected format. Otherwise, if the source of the event has been attacked using a cross-site scripting flaw, further unchecked processing of information sent using the postMessage() method could result in the attack being propagated into the receiver.

Authors should not use the wildcard keyword (*) in the targetOrigin argument in messages that contain any confidential information, as otherwise there is no way to guarantee that the message is only delivered to the recipient to which it was intended.

Authors who accept messages from any origin are encouraged to consider the risks of a denial-of-service attack. An attacker could send a high volume of messages; if the receiving page performs expensive computation or causes network traffic to be sent for each such message, the attacker's message could be multplied into a denial-of-service attack. Authors are encouraged to employ rate limiting (only accepting a certain number of messages per minute) to make such attacks impractical.

The most important thing is to always validate the origin - you'd be surprised how many sites fail to do so. If the message is confidential then the targetOrigin argument must be specified.

This of course assumes that the browser implementation is correct and without holes. The major browsers have been evaluated and no issues have been found.

See also this Checklist for postMessage Security Review.

  • 2
    Fantastic answer! Everything I could've hoped for -- and the checklist is great. Thank you.
    – D.W.
    Sep 28, 2012 at 17:24
  • You (and many others) say "always validate the origin" even when the w3c source only recommends it: "Authors should check the origin". Do you think there may are any security issues the w3c is not aware of, other than the mentioned "bugs in the author's message handling code [that] could be exploited" or the denial-of-service attack? I think if you have very simple messages and take great care that they are validated and sanitized, it seems acceptable not to validate the origin if you can't for some reason.
    – kapex
    Oct 14, 2013 at 17:59
  • 1
    @DavidWachtfogel : does this means sending token credentials through postmessage is risky in the sense an other page can receive them, or did I miss something on how postmessage events works ? Jun 15, 2017 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .