thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

postMessage Origin Validation

Checking the origin of messages received through the browser's window.postMessage API before acting on them.

Definition

postMessage enables cross-origin communication between windows and iframes. Handlers that skip checking event.origin, or send messages with a wildcard target origin, can be abused to inject data, trigger DOM XSS or leak secrets. Validate the exact sender origin and specify the target origin when sending.

Example

A message handler processes event.data only if event.origin equals https://app.example.com.

Exam tip

Always check event.origin and never post sensitive data with targetOrigin '*'.

Related terms