Skip to content

Latest commit

 

History

History
28 lines (18 loc) · 1.31 KB

require-post-message-target-origin.md

File metadata and controls

28 lines (18 loc) · 1.31 KB

Enforce using the targetOrigin argument with window.postMessage()

🚫 This rule is disabled in the ✅ recommended config.

💡 This rule is manually fixable by editor suggestions.

When calling window.postMessage() without the targetOrigin argument, the message cannot be received by any window.

This rule cannot distinguish between window.postMessage() and other calls like Worker#postMessage(), MessagePort#postMessage(), Client#postMessage(), and BroadcastChannel#postMessage(). Use on your own risk.

Fail

window.postMessage(message);

Pass

window.postMessage(message, 'https://example.com');
window.postMessage(message, '*');