otsukare Thoughts after a day of work

Web Messaging API

I gave recently a talk on Web Messaging API. I'm not a specialist of this API but Tiffany Brown (@webinista) has written a comprehensive article about Web Messaging API on

You might know it better under the name of

window.postmessage("message", targetOrigin)

What I learned and shared with others during this talk.

  • The only safe place for interoperability is a parent document and an iframe (on two different domains). This will even work on Opera Mini
  • Using the magical "/" string for targetOrigin will help when you control the two documents on a same domain but will break when one day you will move things around. So avoid.
  • DO NOT EVER use the magical string "*" for targetOrigin or fear the demons of security and cross-site-scripting.
  • Opera has the best implementation across the board
  • ChannelMessage (using a window has a hub for two iframes for examples) is yummy but is not entirely available in all browsers.

If you have other issues, recommendations, chime in the comments.\