> For AI agents: the complete documentation index is available at https://rslint.rs/llms.txt, the full documentation bundle is available at https://rslint.rs/llms-full.txt.

# require-post-message-target-origin

[Added in v0.9.3](https://github.com/web-infra-dev/rslint/releases/tag/v0.9.3)
## Configuration


```ts title=rslint.config.ts
import { defineConfig, unicornPlugin } from '@rslint/core';

export default defineConfig([
  unicornPlugin.configs.recommended,
  {
    rules: {
      'unicorn/require-post-message-target-origin': 'error',
    },
  },
]);
```

Require an explicit `targetOrigin` argument in `.postMessage()` calls so that
messages can be restricted to an intended origin.

## Examples

Incorrect:

```js
window.postMessage(sensitiveData);
window.postMessage({ token: authToken });
iframe.contentWindow.postMessage(data);
```

Correct:

```js
window.postMessage(sensitiveData, 'https://trusted-domain.com');
window.postMessage({ token: authToken }, 'https://api.example.com');
iframe.contentWindow.postMessage(data, 'https://expected-iframe-origin.com');

// Use a wildcard only for non-sensitive public data.
window.postMessage({ publicData: 'hello' }, '*');
```

The rule provides editor suggestions, not automatic fixes. Depending on the
receiver, suggestions use its `location.origin`, `self.location.origin`, or
`'*'`. Choose the intended recipient's origin; a wildcard does not restrict
which origin can receive the message.

## Options

This rule has no options.

## Limitations

Like upstream, this rule cannot distinguish a window from a `Worker`,
`MessagePort`, `Client`, or `BroadcastChannel`. Those APIs do not accept a
`targetOrigin` argument, so enable this rule only where it is appropriate.
The recommended preset explicitly disables this rule, matching upstream. If
you want to enable it, place your rule configuration after the preset.

Computed property access, spread arguments, and optional calls are ignored.
Optional member access, such as `window?.postMessage(message)`, is checked.

## References

- [Upstream documentation](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/v74.0.0/docs/rules/require-post-message-target-origin.md)
- [Upstream implementation](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/v74.0.0/rules/require-post-message-target-origin.js)