title: Why is using '*' as the targetOrigin for postMessage a security risk?
body: <p>I'm having a hard time understanding the security issues when using a wildcard for the targetOrigin of the postMessage() method. Doesn't the window you call postMessage() on already have an origin that we are sending data to? How would someone be able to interfere with that? Would it be bad to set the targetOrigin to the window's origin using <code>window.location.origin</code>?</p>
  
  <p>I understand the importance of checking the event origin on the receiving end (as illustrated <a href="https://community.softwaregrp.com/t5/Protect-Your-Assets/XSS-and-App-Security-through-HTML5-s-PostMessage/ba-p/266645#.WmK2hkvau2w" rel="noreferrer">here</a>), but I can't seem to wrap my head around why it is bad for the sending end to use the wildcard as the targetOrigin when the window already has a specific origin.</p>