Comparing Window references: postMessage event.source

[adam strickland]

Hi there,

I have two sites on the same domain, but on different subdomains, where I need to pass postMessages between the two when one is iframed by the other.

One difficulty I've found is that (in the parent page) I can't always know what domains will be posting to me since sometimes the iframed site may do a 302 redirect to a different subdomain before it posts messages back.

Take this example:

Parent site: parent.example.com

iframed src: child1.example.com

redirected src: child2.example.com

In absence of the redirect, I would know to expect the origin child1.example.com to post back to me. But in the case of a redirect, I'm not able to programmatically check what the current origin of the iframe is (by <frame reference>.contentWindow.window.location) because it is a cross-origin frame and checking the current origin raises a DOMException.

My idea (in the subject) is to use the source attribute of postMessages events, which is a reference to the window that posted the message. In my testing, even if the iframe has redirected since I created it, the window reference I can access from my DOM is equal to the source's window reference. Specifically I was able to make this comparison (and it came back as true):
event.source.window == crossSiteFrame2.contentWindow.window

I have checked this in Chrome and Firefox so far successfully. Any idea if this is more broadly expected behavior (comparing window references, even across domain changes)?