CodePark/ questions / Iframes, sandbox & postMessage
START PRACTICINGPRACTICE
Frontend question · Frontend security › Iframes, sandbox & postMessage

Which sender gets past this origin check?

window.addEventListener("message", (event) => {
  if (!event.origin.includes("example.com")) return;
  applySettings(event.data);
});
A page at https://example.com.attacker.net

The host example.com.attacker.net contains the text example.com, and the attacker owns it. notexample.com passes too. Compare exactly instead: const ALLOWED = new Set(["https://example.com"]) and ALLOWED.has(event.origin).

"None: event.origin can't be faked" is the tempting wrong answer. It's true that the browser sets the origin, but a substring check still accepts hosts the attacker owns. The ?site=example.com page fails, because an origin has no path or query. "null" doesn't contain the text either.