Typically, within the onmessage handler, you would have something like this:

window.onmessage = function(e) {
    if (e.origin != "www.example.com")
    //Do stuff

The check for e.origin is meant to ensure that only that site can access whatever is after the check. However, if my understanding is correct, one cannot send a postMessage to a page unless it is either an IFrame within the page, or through an IFrame on the page to the top level.

However, most of the risks I can think of would hardly make any sense. For example, even if I had something like this:

var superSecretToken = Math.random();
window.onmessage = function(e) {
    e.source.postMessage("Hey, my SUPER SECRET TOKEN is " + superSecretToken + "!", "*");

How would this give any important information to an attacker? If I open the page in an IFrame, the superSecretToken varies each time. If it were always the same, XSS would be pointless since I could just open up the page and read it from the source code.

From my understanding, only an IFrame within the page could send a postMessage and steal the token. However, unless you happen to embed some random page/ad in an IFrame without sandboxing it, and the owner of the site/ad decided to steal a bunch of tokens, this hardly seems like a threat.

So: if a site were to not check the origin of a message before replying, how could an attacker even affect a user of the page?

1 Answer 1


Imagine that the superSecretToken token was something retrieved from your service's server and was specific to the authenticated user. Or imagine that it was the user's bank balance.

Then any random webpage on the internet could embed your page in an iframe, and whenever someone visited the attacker's page and happened to be logged into your service, the iframe would postMessage the user's bank balance or whatever to the attacker's page. It gets even worse if the iframe accepts commands to make changes to the user's account, because then the attacker's page could send an arbitrary message to the iframe to make changes in the user's account, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .