Skip to main content

postMessage protocol (v1)

All messages include v: 1. HTML and React use the same protocol. See Embed with React.

Parent → iframe

iframe → parent

Hardening

  • Compare event.origin to https://embed.withheadlight.com
  • Require event.source === iframe.contentWindow
  • Pass an explicit targetOrigin to postMessage