# postMessage origin not validated

Message handlers and token relays that skip origin checks or take target origin from request params

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; 3 confirmed bounties, median $1,200, range $1,000-$3,000; latest 2020-11-21. Updated 2026-10-23._

## How it works
A page receives or sends a `postMessage` and trusts the wrong party. Either the listener acts on any message without checking `evt.origin`/`evt.source`, or a token-relay page picks its `targetOrigin` and routing from URL parameters the attacker controls. The assumption that breaks: that only the intended window can talk to the handler, or that the target origin is fixed by the app. Neither holds — any cross-origin page can post to a listener, and any URL param can be set by an attacker.

## Where it shows up
- `addEventListener('message', ...)` handlers with no `evt.origin` or `evt.source` check [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token.md)
- A dispatch table of `message_type` values, some state-changing (reconnect, redirect, goodbye) [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token.md)
- Token/response relay pages reading `targetOrigin` or a `requestID`-style param from the query string [E3](https://bugbountylibrary.com/r/h1%3A821896.md)[E4](https://bugbountylibrary.com/r/h1%3A826394.md)
- Branches that route to `window.opener` vs `parent` based on a param prefix [E3](https://bugbountylibrary.com/r/h1%3A821896.md)[E4](https://bugbountylibrary.com/r/h1%3A826394.md)
- `postMessage(..., '*')` on any page that carries a token [E4](https://bugbountylibrary.com/r/h1%3A826394.md)
- Origin comparison done with `search`/`match`/`indexOf`/`endsWith` instead of exact equality [E2](https://bugbountylibrary.com/r/h1%3A129873.md)

## How to review
For every listener, confirm the handler rejects messages whose `origin` is not an exact allowlisted value and whose `source` is not the expected window, before any state change. Check the comparison itself: `search`/`match` treat the origin as a regex (dots become wildcards), and `indexOf`/`endsWith` accept substrings — only strict equality against a fixed string is safe [E2](https://bugbountylibrary.com/r/h1%3A129873.md). For every sender, confirm `targetOrigin` is a hardcoded or server-derived constant, never read from a request parameter, and that routing (opener/parent) cannot be selected by attacker input. The invariant: a token leaves the page only to a fixed, trusted origin, and a handler acts only on messages from a fixed, trusted origin.

## Variants seen
- Missing origin check on internal message handlers, chained with a redirect endpoint to leak a session token [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token.md)
- Origin check using `String.search()` with the attacker origin as regex, so a lookalike domain matches [E2](https://bugbountylibrary.com/r/h1%3A129873.md)
- Relay page deriving `targetOrigin` from a query param, with `requestID` prefix selecting the opener branch [E3](https://bugbountylibrary.com/r/h1%3A821896.md)
- Same relay sending with wildcard `*` to `window.opener` [E4](https://bugbountylibrary.com/r/h1%3A826394.md)

## Impact and severity
Full account takeover via stolen OAuth/session tokens [E1](https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token.md)[E3](https://bugbountylibrary.com/r/h1%3A821896.md)[E4](https://bugbountylibrary.com/r/h1%3A826394.md); bounties $1000–$3000, median $1200. Worse when the leak needs no user interaction beyond visiting a page, and when the token grants broad API scope.

## Why fixes fail
Evidence does not show incomplete fixes for this pattern. (E1's CSP/JSONP bypass is a fix-failure lesson but belongs to a different weakness.)

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token.md
- E2: https://bugbountylibrary.com/r/h1%3A129873.md
- E3: https://bugbountylibrary.com/r/h1%3A821896.md
- E4: https://bugbountylibrary.com/r/h1%3A826394.md