​

postMessage protocol (v1)

​

Parent → iframe

​

iframe → parent

​

Hardening

• Compare event.origin to the token’s frameOrigin
• Require event.source === iframe.contentWindow
• Pass an explicit targetOrigin to postMessage
• Ignore non-render commands until token verification succeeds