title: postMessage target origin - window.parent.origin vs "*"
body: <p>Is <code>window.parent.postMessage(message, window.parent.origin)</code> more secure than <code>window.parent.postMessage(message, '*')</code>?</p>
  
  <p>We have an iframe component that is loaded by a parent frame. That frame can be from anywhere (our web application is a shared component and can be accessed from any client installation of our main product). So we can't know in advance who loaded us unless we keep some kind of database with allowed origins which we don't.</p>
  
  <p>We are sending a <code>postMessage()</code> to our parent frame, and we can't know the target origin in advance, so I put <code>'*'</code>. I colleague of mine suggested I use <code>window.parent.origin</code> instead, but as far as I understand this has the same effect - <code>postMessage</code> will check that the target origin is the same as itself! Not to mention that it fails when cross-domain.</p>
  
  <p>So am I missing something here? Does using <code>window.parent.origin</code> confer any greater security than a wildcard?</p>