I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.
From what I was able to understand, the information is exchanged between the iframes using internal browser APIs, without any network communication. In other words, even if the two iframes exchanging information between them are hosted in two different servers originating from two different domains, I will not see any traffic being exchanged between these two servers when messages are posted. Before implementing this on my website, I just want to be sure - How does the browser validate the origin of the posted message? Is there any way an attacker can "spoof" a message and make it look like it originated from a legitimate iframe? I am guessing the answer is no because that would require reverse engineering the browser and exposing its internal APIs, but I just want to make sure that my understanding is correct.
Thanks in advance