Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Any good debugger for HTML5 Javascript postMessage API? [closed]

Tags:

Is there any good tool out there that allows developers to correctly debug messages sent between windows with postMessage?

Or maybe a plugin for Firebug?

like image 292
Pierre Duplouy Avatar asked Jun 16 '10 13:06

Pierre Duplouy


People also ask

Is window postMessage secure?

Security-Reviewing Uses of postMessage()postMessage is generally considered very secure as long as the programmer is careful to check the origin and source of an arriving message. Acting on a message without verifying its source opens a vector for cross-site scripting attacks.

Can I use window postMessage?

window. postMessage() is a safe way to send messages between windows in different domains or origins. One can also post to an IFrame. The data being sent is serialized using the structured clone algorithm and will accept almost any type of simple or complex data.

What is postMessage JavaScript?

postMessage() method safely enables cross-origin communication between Window objects; e.g., between a page and a pop-up that it spawned, or between a page and an iframe embedded within it.


1 Answers

Firebug (as of 1.11 beta 1) supports this with monitorEvents(). You can do something like this:

$("iframe").each(function(i, e) {     console.log("Monitoring messages sent to: iframe(" + i + ")#" + $(this).attr("id"));     monitorEvents(this.contentWindow, "message");           // Send a test message to this iframe     this.contentWindow.postMessage("Hi iframe - " + i, "*");  });  console.log("Monitoring messages sent to window"); monitorEvents(window, "message");  // Send a test message to the window window.postMessage("Hi window", "*");  

(@Pierre: thanks for mentioning that feature request)

EDIT: Also works in Chrome, though when I tried the above code I encountered a security error that the document.domain values were not the same, so the behavior of these two implementations may be slightly different.

UPDATE: I have submitted a feature request to the Chrome team asking that postMessage events appear in the timeline. Also, I found an extension called JScript Tricks that can inject arbitrary JavaScript code into a page when it is loaded. You can add the following code to it to monitor events once the page loads. It works pretty well, though it might miss events that occur immediately (e.g. before onload, if that's possible).

(function($) {     var $window = $(window);     $window.add("iframe").on("message", function(e) {         console.log("Received messsage from " + e.originalEvent.origin + ", data = " + e.originalEvent.data);     }); })(jQuery); 
like image 163
jacobq Avatar answered Jan 01 '23 22:01

jacobq