CS Fundamentals Trainer · JavaScript · Security

A login popup sends the user's access token with window.opener.postMessage({ token }, '*'). What is the risk?

A login popup sends the user's access token with `window.opener.postMessage({ token }, '*')`. What is the risk?

  1. The `'*'` target broadcasts the message to each open tab and window in the browser.
  2. The token is appended to the opener's URL in plain text, where it ends up in server logs.
  3. The `'*'` target turns off structured cloning, so extensions can read the message as text.
  4. If the opener is an attacker's page (or has navigated to another origin), that page receives the token.

Difficulty: hard

Answer this question

Related questions