# window.postMessage Resources

## Knowledge

- [MDN: Window.postMessage()](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage)
  Author-facing primary: syntax (positional + options), `targetOrigin` (default `"/"`), structured clone + transfer, dispatched `MessageEvent` (`data`, `origin`, `source`), security rules (`*` is leaky, always check `event.origin`, verify payload shape). Use for: lesson 1 and any claim about the window mailbox.
- [WHATWG HTML: §9.3 Cross-document messaging](https://html.spec.whatwg.org/multipage/web-messaging.html#web-messaging)
  Normative: author security rules, silent drop when target origin mismatches, default `targetOrigin` `"/"`, `StructuredSerializeWithTransfer`, task-queued `message` / `messageerror`. Use for: any claim when MDN is vague.
- [WHATWG HTML: window post message steps](https://html.spec.whatwg.org/multipage/web-messaging.html#window-post-message-steps)
  Task-queued `message`. No listener at fire time means the event is gone. Use for: lesson 4 — do not send before ready.
- [MDN: HTMLIFrameElement](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement)
  `contentWindow` exists before the child document is ready. `load` is not a ready message. Use for: lesson 4.
- [WHATWG HTML: §9.3.2 Security](https://html.spec.whatwg.org/multipage/web-messaging.html#security-postmsg)
  Check `origin`; check data format even after that; never `*` with confidential data; DoS via flood. Use for: the two-stamp lesson and deal-breakers.
- [MDN: Same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Same-origin_policy)
  Scheme/host/port; what a cross-origin `WindowProxy` still exposes (`postMessage`, `blur`/`focus`/`close`, `closed`, `frames`, `opener`/`parent`/`top`, limited `location`). Use for: “the reference is not the object.”
- [MDN: Window.parent](https://developer.mozilla.org/en-US/docs/Web/API/Window/parent) / [Window.top](https://developer.mozilla.org/en-US/docs/Web/API/Window/top)
  Parent is the embedder; if there is no embedder, parent is this window. `top` is the outermost page. Use for: lesson 2 handle map.
- [MDN: Window.opener](https://developer.mozilla.org/en-US/docs/Web/API/Window/opener)
  Handle of the page that called `open` or navigated a targeted link. `null` with `noopener`, modern `target=_blank`, or COOP. Use for: popup is not an iframe.
- [MDN: Window.open()](https://developer.mozilla.org/en-US/docs/Web/API/Window/open)
  Returns a WindowProxy, or `null` if blocked or `noopener`. Must run on a user gesture. Use for: store the return value; `closed`.
- [MDN: HTMLIFrameElement.contentWindow](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/contentWindow)
  WindowProxy of the iframe’s window. Same-origin: you can read `document`. Compare with `event.source` to find which iframe sent. Use for: the iframe element is not the handle.
- [WHATWG HTML: Cross-origin objects](https://html.spec.whatwg.org/multipage/nav-history-apis.html#cross-origin-objects)
  Normative WindowProxy cut-down surface. Use for: what you can legally touch without posting.
- [MDN: MessageEvent](https://developer.mozilla.org/en-US/docs/Web/API/MessageEvent)
  Shared event shape (`data`, `origin`, `source`, `ports`, `lastEventId`) across window, ports, workers, BC, SSE, WebSocket. Use for: field map; do not treat every `message` event as window-postMessage.
- [MDN: MessageEvent.source](https://developer.mozilla.org/en-US/docs/Web/API/MessageEvent/source)
  WindowProxy, MessagePort, or ServiceWorker. Window case: reply handle. Use for: lesson 3.
- [MDN: Mapping message sources to iframes](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/contentWindow#mapping_message_sources_to_iframes)
  `event.source === iframe.contentWindow` after an origin check. Use for: two widgets, one listener.
- [MDN: Channel Messaging API](https://developer.mozilla.org/en-US/docs/Web/API/Channel_Messaging_API)
  Two-way pipe with a port at each end. Use for: MessageChannel orientation.
- [MDN: MessagePort.close()](https://developer.mozilla.org/en-US/docs/Web/API/MessagePort/close)
  Disconnects the port. HTML: `close()` sets detached and disentangles; the other end fires `close`. A later `postMessage` has no target port and does not deliver (may return, may throw). Use for: lesson 7.
- [MDN: Using channel messaging](https://developer.mozilla.org/en-US/docs/Web/API/Channel_Messaging_API/Using_channel_messaging)
  Worked iframe example: create channel, transfer `port2`, `onmessage` vs `addEventListener` + `start()`. Use for: the pipe lesson.
- [WHATWG HTML: §9.4 Channel messaging](https://html.spec.whatwg.org/multipage/web-messaging.html#channel-messaging)
  Entangled ports, transfer steps, `start`/`close`, GC. Especially [§9.4.1.2 Ports as an object-capability model](https://html.spec.whatwg.org/multipage/web-messaging.html#ports-as-the-basis-of-an-object-capability-model-on-the-web). Use for: why a transferred port is not “another mailbox.”
- [MDN: MessageChannel](https://developer.mozilla.org/en-US/docs/Web/API/MessageChannel) / [MessagePort](https://developer.mozilla.org/en-US/docs/Web/API/MessagePort)
  Constructor, `port1`/`port2`, `postMessage`, `start`, `close`. Use for: API sheet.
- [MDN: BroadcastChannel](https://developer.mozilla.org/en-US/docs/Web/API/BroadcastChannel)
  Same-origin named bus; no `targetOrigin`. Use for: “when the public mailbox is the wrong shape.”
- [MDN: Structured clone algorithm](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm)
  What clones / throws / transfers. Use for: payload rules — this track consumes the Structured Clone topic, does not re-teach the type matrix.
- [web.dev: Same-origin policy](https://web.dev/articles/same-origin-policy)
  Readable SOP explainer. Use for: optional second pass on the boundary.

## Wisdom (Communities)

- [Stack Overflow — [postmessage]](https://stackoverflow.com/questions/tagged/postmessage)
  Origin-check bugs, sandboxed `origin: "null"`, iframe readiness races. Use for: edges — verify against MDN/spec.
- [r/webdev](https://www.reddit.com/r/webdev/)
  Product-context “how do I talk to this iframe” threads. Use for: second opinions; treat as anecdotes.

## Gaps

- No single modern long-form “postMessage design guide” that also owns MessageChannel capabilities. Teach the mailbox + two stamps first, then the port as a capability, from MDN + HTML §9.3–9.4.
- Exact `file://` origin treatment is implementation-dependent (MDN SOP). This workspace opens lessons as files; the lab must stay honest on `file://` (stamps serialize as `"null"`; an origin-string check cannot tell two opaque origins apart). Do not design production mail as if `file:` were an origin you can name.