require-post-message-target-origin.md

Enforce using the targetOrigin argument with window.postMessage()

💡 This rule provides suggestions.

When calling window.postMessage() without the targetOrigin argument, the message cannot be received by any window.

This rule cannot distinguish between window.postMessage() and other calls like Worker#postMessage(), MessagePort#postMessage(), Client#postMessage(), and BroadcastChannel#postMessage(). Use on your own risk.

Fail

window.postMessage(message);

Pass

window.postMessage(message, 'https://example.com');

window.postMessage(message, '*');