Safe use of window.postMessage, is "if ( event.source !== window){return;}" alright?

Viewed 6128

I'd like to use window.addEventListener("message",myOnmessageCallback,false) for receiving messages only coming from my window itself. (this is to say I do not want to needlessly make the myOnmessageCallback function prone to be receiving malicious messages from some other sources (I assume such might be other frames, browsersWindows, tabs, parent and iframes, right?).

Therefore I thought, if this avoid touching anything from not my window itself.

function myOnmessageCallback(event)
{
  if(event.orign !== window)
  {
  // I assume the message is from not this window here, therefore ignore it.
  return;
  }

  //do some useful stuff with the message received (only from window)
}

Does this seem a good way to reduce the myOnmessageCallback callback for just dealing with messages send via window.postMessage() of the webpage itself?

PS: For those who think why I desire such reduced postMessage onmessage capabilities. I want to have a way to put something in the Javascript execution Queue, allowing the handling of UI stuff in between. I would use the classical window.setTimeout but this has the minimum time and I do not want to needlessly waste time.

1 Answers
Related