---
title: "JavaScript – Avoid Unrestricted targetOrigin On Cross-Domain Messaging"
description: "Impact Area Security Severity High Affected Element All ## Rule number **SN-0134** ## Impact HTML5 adds the ability to send messages to documents served from other domains. If improperly used, this can cause a data leak. ## Remediation Do not…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/javascript-rules/javascript-avoid-unrestricted-targetorigin-on-cross-domain-messaging/"
updated: "2025-03-21"
category: Best Practices Rules / JavaScript Rules
---

# JavaScript – Avoid Unrestricted targetOrigin On Cross-Domain Messaging

Impact Area

Security

           Severity

High

           Affected Element

All

## Rule number

**SN-0134**

## Impact

HTML5 adds the ability to send messages to documents served from other domains. If improperly used, this can cause a data leak.

## Remediation

Do not use unrestricted targetOrigin calls.

### Time to fix

20 min

## References

This rule is linked to [Common Weakness Enumeration CWE-1021 Improper Restriction of Rendered UI Layers or Frames](https://cwe.mitre.org/data/definitions/1021.html).

## Code examples

### Noncompliant code

When sending message: `var iframe = document.getElementById("testiframe"); iframe.contentWindow.postMessage("secret", "*"); // Noncompliant: * is used`

When receiving message: `window.addEventListener("message", function(event) { // Noncompliant: no checks are done on the origin property. console.log(event.data); });`

### Compliant code

When sending message: `var iframe = document.getElementById("testsecureiframe"); iframe.contentWindow.postMessage("hello", "https://secure.example.com"); // Compliant`

When receiving message: `window.addEventListener("message", function(event) { if (event.origin !== "http://example.org") // Compliant return; });`