CS Fundamentals Trainer · JavaScript · Security

A page listens for message events from an embedded widget at https://widget.example. Which checks make the handler safe?

A page listens for `message` events from an embedded widget at `https://widget.example`. Which checks make the handler safe?

  1. Comparing `event.origin` exactly against `'https://widget.example'`
  2. Validating the type and shape of `event.data` before using it
  3. Accepting the message if `event.origin.includes('widget.example')`
  4. Trusting an `origin` field the sender puts inside `event.data`
  5. Checking that `event.source === iframe.contentWindow`

Difficulty: medium

Answer this question

Related questions