Skip to main content
XsiSec.com
HomeReposBlogProjectsPortfolio
Š 2026 XsiSec.com
Security rules |security.txt
Updated 2026-08-15 ¡ v1.0.0+2026-08-14.82f92cb ¡ 82f92cb
← Back to overview
Security article

WebListeners

WebListeners: 📝 What I Learned In this article I explored how an EventListener works together with postMessage in JavaScript. This also involved verifying the origin header for security. • Knowledge • DOM, DOM-based • dom, dom-based

2022-12-023 tags
Tags

📝 What I Learned

In this article I explored how an EventListener works together with postMessage in JavaScript.
This also involved verifying the origin header for security.


🔎 Sender Example

Using a form to send a message into an iframe:

html
form.onsubmit = function() { 
  iframe.contentWindow.postMessage(this.message.value, '*'); 
  return false; 
};

📥 Receiver Example

The receiving side is implemented using window.addEventListener:

html
Test   
# LISTENER

window.addEventListener('message', function(e) { 
  var origin = e.origin; 
  if(origin !== 'http://localhost') return;

  document.getElementsByTagName('p')[0].innerHTML =
    'Message from BjÜrntjänsteman: ' + e.data; 

  console.log('Message test ' + e.data); 
}, false);

📸 Screenshots

Form submission and postMessage sending:
Sender Screenshot

Message received and displayed in the listener:
Receiver Screenshot


✅ Result

  • Learned how to send and receive messages between documents using postMessage.
  • Verified and checked the origin header to ensure security.
  • Successfully displayed the message in the receiving document.
Navigate

In this post

  1. 01📝 What I Learned
  2. 02🔎 Sender Example
  3. 03📥 Receiver Example
  4. 04📸 Screenshots
  5. 05✅ Result
Search
Explore

Popular tags

Browse all 30 tags

Comments

0 comments

No comments yet — be the first to comment.