postMessage() is a good approach if used correctly. I have read the vast resources about how to use it to make sure it’s implemented in a secure way and came up with the code. However, as I am still new to coding, I am paranoiac about XSS vulnerabilities and this code looks too simple to me to be fully secure. I would appreciate if someone can review it.
- The message must be sent from the iframe to the parent window only
- The iframe is HTTPS, while the parent is HTTP
- The message doesn’t contain sensitive data – it’s just a simple indicator for the parent window to do trigger a google tag manager custom event
- Parent window domain in the example is:
- Iframe domain in the example is:
- Is the code exposed to security risks?
- Are there other risks apart that the attacker might find out the message content is 'download'? For example, can meticulous code be injected through the message?
Receiver (parent window):