postMessage protocol (v1)
All messages includev: 1. HTML and React use the same protocol. See Embed with React.
Parent → iframe
iframe → parent
Hardening
- Compare
event.origintohttps://embed.withheadlight.com - Require
event.source === iframe.contentWindow - Pass an explicit
targetOrigintopostMessage