postMessage in HTML5 to send messages between windows and iframes
Ever had the need to communicate between windows or the current window and an inner iframe? Across domains as well? I bet you have, but now we have a nice option for doing that!
The solution is called postMessage and is part of the HTML5 Web Messaging specification. What makes it cool, and very easy to use, is that all you need to trigger it is to call a method and add an event handler:
- Call the
postMessage
method of the window/iframe element you want to send the information to. - Specify origin. Should be a domain or a wildcard
"*"
- In the receiving window, just add an event listener for the
message event
. - Optional: add an origin check for security reasons.
The code to do this
In this example we will have one containing page with a form, posting a message to an iframe
in that page.
Code used in the containing page
<form id="the-form" action="/"> <input type="text" id="my-message" value="Your message"> <input type="submit" value="postMessage"> </form> <iframe id="da-iframe" src="postMessageTarget.html"></iframe>
window.onload = function () { var iframeWin = document.getElementById("da-iframe").contentWindow, form = document.getElementById("the-form"), myMessage = document.getElementById("my-message"); myMessage.select(); form.onsubmit = function () { iframeWin.postMessage(myMessage.value, "https://robertnyman.com"); return false; }; };
Code used in the iframe
<p id="received-message">I've heard nothing yet</p>
function displayMessage (evt) { var message; if (evt.origin !== "https://robertnyman.com") { message = "You are not worthy"; } else { message = "I got " + evt.data + " from " + evt.origin; } document.getElementById("received-message").innerHTML = message; } if (window.addEventListener) { // For standards-compliant web browsers window.addEventListener("message", displayMessage, false); } else { window.attachEvent("onmessage", displayMessage); }
Web browser support
The nice thing is that this is supported in:
- Internet Explorer 8.0+
- Firefox 3.0+
- Safari 4.0+
- Google Chrome 1.0+
- Opera 9.5+
Demo and my HTML5 playground
You can see the above code in action at my postMessage demo, which is part of a new testing ground on my web site, HTML5 – Information and samples for HTML5 and related APIs which displays various HTML5 examples, the code to run them and web browser compatibility..
Play around and enjoy! 🙂
Cool! You should check out pmrpc – http://code.google.com/p/pmrpc/ – a HTML5 JavaScript library for RPC-style (remote procedure call) inter-window and web workers communication. The library is based on postMessage (both the inter-window API and worker API).
It seems like the support in IE8 is somewhat limited, it only works in frames/iframes and have some issues with both session and local storage. See Eric Lawrence's blog http://bit.ly/HwrlP
easyXDM (http://easyxdm.net/) is also a library using postMessage (and several fallback techniques) for supporting cross-domain RPC, just like pmrpc, but easyXDM has more advanced functionality and to be honest, better code structure and documentation.
Ivan,
Thanks for the tip!
Henrik,
Ah, good to know! Thanks!
Sean,
Good, great to have alternatives!
Hi,
I have a public facing SharePoint 2010 site.
Scenario: We are using cross scripting to show external sites information in our, site. We have pages with a Page Viewer web part ad CEWP. Height and scrolling issue of Page Viewer web part is resolved using cross scripting.we followed the below blog to resolve.
http://blog.johnmckerrell.com/2006/10/22/resizing-iframes-across-domains/
i want to make 100% sure that no search enginer like Google will mark our public facing SPSite as phishing site due to this cross site scripting??
If you anybody want me to elaborate my question please let me know.
Regards
Guru
guru,
Impossible to tell, but I hope Google can distinguish the difference.
Thanks to your article
Well it works well in your own window but it does work from other domain. I am using curl and never received message.
Please take a look at a working demo of cross-domain postMessage.