hard20 pts · first answer countsweb-securitybrowser-apis

Unsafe postMessage listener

A login popup sends a token to the main window. What is the security bug in this listener?

window.addEventListener('message', (event) => {
  if (event.data.type === 'login') {
    saveToken(event.data.token)
  }
})

A.It never checks event.origin, so any page that can get a reference to this window can send a fake tokenB.It should use event.detail instead of event.dataC.message events can only carry strings, so event.data.type is always undefinedD.The listener must be registered on document, not window

Discussion 0

Join free to post in the discussion.

Unsafe postMessage listener

Discussion 0

Related questions