FrontendHaltSecurity·Intermediate·Conceptual·1 min read
How should postMessage be used securely?
Short interview answer
Send to an exact targetOrigin rather than *, and on receipt verify event.origin and, where relevant, event.source. Validate the message schema and treat payloads as untrusted. Origin checking without payload validation is insufficient.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.