I have a web page (non public) with an iframe, where the relation between outer page and iframe is same-site cross-origin. To send events from the outer page to the inner page, I'm using postMessage() calls.
The events do things such as start playback on a webAudio object in the inner page – which requires a user gesture in order to not be considered "auto play" which gets blocked by the browser.
Sending a postMessage event to start playback works fine as long as both pages (outer and inner) have the same document.domain property, but document.domain is deprecated and not a future-proof solution here. so I cannot rely on it.
So when sending a cross-origin same-site postMessage call to start audio playback in Chrome – without document.domain and without first clicking in the iframe in order to make an "interaction" with it – the response will be "The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page.".
The problem seems to be that user gestures are not following along with the postMessage event.
From what I can gather on the web, postMessage should still be a working method for making such calls between same-site, cross-origin pages, so I don't understand why it's not working. There are a few bug reports that touch upon this issue (such as this one), but to my understanding, the issue should be solved by now.
I have tried the Message Channel API, which still uses postMessage, and did not get any different results.
Is there a solution to this? On developer.chrome.com they mention sending the "Origin-Agent-Cluster: ?0" header as a "last resort", but is this really the only solution here?