
When sending a message, avoid using `*` for the target origin (it means no preference). Instead define it explicitly so the message will only be dispatched to this URI.
When receiving the message, verify the orgin to be sure that it is sent by an authorized sender.

=== Code examples

==== Noncompliant code example

When sending a message:

[source,javascript,diff-id=1,diff-type=noncompliant]
----
var iframe = document.getElementById("testiframe");
iframe.contentWindow.postMessage("hello", "*"); // Noncompliant: * is used
----

When receiving a message:

[source,javascript,diff-id=2,diff-type=noncompliant]
----
window.addEventListener("message", function(event) { // Noncompliant: no checks are done on the origin property.
  console.log(event.data);
 }); 
----


==== Compliant solution

When sending a message:

[source,javascript,diff-id=1,diff-type=compliant]
----
var iframe = document.getElementById("testiframe");
iframe.contentWindow.postMessage("hello", "https://secure.example.com");
----

When receiving a message:

[source,javascript,diff-id=2,diff-type=compliant]
----
window.addEventListener("message", function(event) {
  if (event.origin !== "http://example.org")
    return;

  console.log(event.data)
}); 
----
