close
Rslint

    require-post-message-target-origin

    Unreleased

    Configuration

    rslint.config.ts
    import { defineConfig, unicornPlugin } from '@rslint/core';

export default defineConfig([
  unicornPlugin.configs.recommended,
  {
    rules: {
      'unicorn/require-post-message-target-origin': 'error',
    },
  },
]);

    Require an explicit targetOrigin argument in .postMessage() calls so that messages can be restricted to an intended origin.

    Examples

    Incorrect:

    window.postMessage(sensitiveData);
window.postMessage({ token: authToken });
iframe.contentWindow.postMessage(data);

    Correct:

    window.postMessage(sensitiveData, 'https://trusted-domain.com');
window.postMessage({ token: authToken }, 'https://api.example.com');
iframe.contentWindow.postMessage(data, 'https://expected-iframe-origin.com');

// Use a wildcard only for non-sensitive public data.
window.postMessage({ publicData: 'hello' }, '*');

    The rule provides editor suggestions, not automatic fixes. Depending on the receiver, suggestions use its location.origin, self.location.origin, or '*'. Choose the intended recipient's origin; a wildcard does not restrict which origin can receive the message.

    Options

    This rule has no options.

    Limitations

    Like upstream, this rule cannot distinguish a window from a Worker, MessagePort, Client, or BroadcastChannel. Those APIs do not accept a targetOrigin argument, so enable this rule only where it is appropriate. The recommended preset explicitly disables this rule, matching upstream. If you want to enable it, place your rule configuration after the preset.

    Computed property access, spread arguments, and optional calls are ignored. Optional member access, such as window?.postMessage(message), is checked.

    References