Reference

postMessage glossary

These words match CONTEXT.md. Lessons use these words only.

Lesson 1 Lesson 2 Lesson 3 Lesson 4 Lesson 5 Lesson 6 Lesson 7 Lesson 8 Rules sheet Words Resources Mission
Origin
A scheme, a host, and a port. Example: https://app.example. Do not use “domain” or “site” for this.
Same origin
The scheme, the host, and the port all match. Path can be different. Port must match.
WindowProxy
The handle you hold for another window: iframe.contentWindow, window.parent, window.top, window.opener, or the result of window.open. Same origin: you can use it as the window. Different origin: you can send data with postMessage.
contentWindow
The WindowProxy of the window inside an iframe element. The iframe element is not a WindowProxy.
parent
The WindowProxy of the embedding page. If this page is not in an iframe, parent is this window.
top
The WindowProxy of the outermost page. If this page is not in an iframe, top is this window.
opener
The WindowProxy of the page that opened this window. If no page opened this window, opener is null.
postMessage
otherWindow.postMessage(data, targetOrigin). The browser sends a structured clone of data to the other window. This is not a function call.
targetOrigin
The origin that may receive the data. If the receiver origin does not match, the browser discards the data and does not throw. "/" means “the same origin as you” (this is the default). "*" means any origin.
event.origin
The origin of the sender at the time of the send. You must check this field. If you skip the check, any holder of your WindowProxy can send data to you.
ready
A message the child sends after it has added its listener. The parent waits for this message before it sends data. A new document must send ready again.
event.source
The WindowProxy of the sender. Reply with event.source.postMessage(reply, event.origin). Compare it to iframe.contentWindow to find the iframe element. Later this field can also be a MessagePort.
MessageEvent
The event that you receive. The fields that matter here are data, origin, and source.
Same-origin policy
The browser rule: a script may read another document only when the origins match. Across origins, use postMessage.
Opaque origin
An origin that is not a scheme-host-port. Examples: data: URLs, a sandbox iframe without allow-same-origin, often file:. The text of this origin is "null". You cannot set targetOrigin to "null". You must use "*" to send to it.
Structured clone
The copy of the data that the browser makes for postMessage. The Structured Clone topic owns the type list.
Browsing context
A tab, a window, an iframe, or a popup. Each one has a window and a document.
Realm
One JavaScript global. Values do not move by reference across realms.
MessageChannel
Two paired ports. You keep one port. You transfer the other port with postMessage after ready.
MessagePort
One end of a MessageChannel. After you transfer that end, you cannot use it. A port has no targetOrigin. On a port message, event.origin is the empty string.
close
port.close() disconnects the pair. After close, a send does not arrive. The other end fires close.