Insecure PostMessage Configuration

Detects careless use of the HTML5 Web Messaging API (postMessage), such as sending messages to the generic '*' origin.

zakirkun e259e9a 2 files · 1007 B Updated

File contents

Insecure PostMessage Configuration

Overview

Detects careless use of the HTML5 Web Messaging API (postMessage), such as sending messages to the generic '*' origin.

Remediation

Always specify the exact target origin in window.postMessage(). When receiving messages, rigorously verify event.origin.

zakirkun/ice-tea/tree/main/skills/web/insecure-postmessage commit e259e9a224

Frequently asked questions

npx skillmds@latest add zakirkun/insecure-postmessage-configuration