Testing an iframe’s postMessage Handler – Master.dev Blog
blog.master.dev
There are some real complexities using iframes and the postMessage API for communication between a widget and its parent. Security vulnerabilities like cross-origin scripting risks being one.