Cross-Origin postMessage Origin Guard

Release: GCD-WEB-045 v1.0.1

Never configure a wildcard or opaque origin. Validate the exact origin and source window on every received message, and send with an exact targetOrigin.

Five-minute verification

  1. Install Node.js 20 or newer.
  2. Open a terminal in the extracted folder and run npm test.
  3. Run npm run example; the expected output is ready.
  4. Review examples/browser-receiver.js without copying its example domains into production.

Production integration

  1. Capture the intended iframe or popup window reference.
  2. Configure reviewed canonical HTTPS origins and a unique channel.
  3. Define one narrow payload validator per allowed action.
  4. Attach the guarded listener and dispose it during teardown.
  5. Test wrong origin, wrong source, navigation, malformed data, oversized data, duplicate frames, authorization, and rollback.

Read README.md for payload limits, failure reasons, security boundaries, and sender requirements before deployment.