windowMessagingTargetOrigin
Requires specifying the targetOrigin argument when calling window.postMessage().
✅ This rule is included in the browser logical preset.
When calling window.postMessage() without the targetOrigin argument, the message cannot be received by any window.
The targetOrigin parameter specifies which origin is allowed to receive the message.
Omitting this argument is a common mistake that prevents cross-window communication from working.
Always specify a target origin (for example, 'https://example.com' or '*' for any origin) as the second argument to postMessage().
Examples
Section titled “Examples”window.postMessage("message");self.postMessage("message");parent.postMessage("message");top.postMessage("message");window.postMessage("message", "https://example.com");window.postMessage("message", "*");self.postMessage("message", "https://example.com");parent.postMessage("message", "*");// Worker, MessagePort, and other postMessage calls are not affectedworker.postMessage("message");Options
Section titled “Options”This rule is not configurable.
When Not To Use It
Section titled “When Not To Use It”If you are developing a specialized internal application on a custom platform with unusual postMessage semantics, you may need to disable this rule.
Further Reading
Section titled “Further Reading”Equivalents in Other Linters
Section titled “Equivalents in Other Linters”
Made with ❤️🔥 in Boston by
Josh Goldberg and contributors.