postMessage doesn't work from a child "localhost" window to an intranet host window

Issue #12985202 • Assigned to Steven K.

Details

Author
Andrew L.
Created
Jul 28, 2017
Privacy
This issue is public.
Found in
  • Microsoft Edge
Found in build #
40.15063
Reports
Reported by 1 person

Sign in to watch or report this issue.

Steps to reproduce

Hello,

I have two web pages - Host and Child (see attached). The Host web page is hosted on a server that is on my local network. The Child page is hosted on my computer. The Host page opens up the child page, using “localhost” in a window.open() call. The Child page then posts a message back to the Host page using the window.postMessage() method (https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage).

In IE and Chrome, the postMessage() works from the “localhost” page to the page that is hosted on the other server. In Edge, it does not work. The “message” event is not even fired on the host page.

Now, if I put the Host page on a server that is not on my local network, the postMessage() method does work and the “message” event is fired. IE had a concept of intranet vs. internet sites, and I wonder if Edge has the same concept except that there is no way of configuring it.

Is there anything I’m doing here that isn’t allowed in Edge. I don’t see why this should be blocked due to security, because postMessage() is a secure way to perform messaging between pages on different domains.

Thanks!

Attachments

Comments and activity

  • Microsoft Edge Team

    Changed Assigned To to “Steven K.”

  • Hi Andrew,

    There is another bug report that I believe is blocking your test scenario.  The opener object is undefined for new windows/pop-ups and so the message does not get sent.

    https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/11324352/

    As a workaround can you try your test using an inline iFrame?

    Thanks,

    Steve

  • Steven K, I have confirmed that yes - the window.opener object is undefined in Edge. I will look into the inline iframe option.

You need to sign in to your Microsoft account to add a comment.

Sign in