title: How do you use window.postMessage across domains?
body: <p>It seems like the point of <a href="https://developer.mozilla.org/en/DOM/window.postMessage" rel="noreferrer">window.postMessage</a> is to allow safe communication between windows/frames hosted on different domains, but it doesn't actually seem to <em>allow</em> that in Chrome.</p>
  
  <p>Here's the scenario:  </p>
  
  <ol>
  <li>Embed an &lt;iframe&gt; (with a <code>src</code> on domain B<sup>*</sup>) in a page on domain A </li>
  <li>The &lt;iframe&gt; ends up being mostly a &lt;script&gt; tag, at the end of which's execution...</li>
  <li>I call window.postMessage( <em>some_data</em>, <em>page_on_A</em> )</li>
  </ol>
  
  <p>The &lt;iframe&gt; is most definitely in the context of domain B, and I've confirmed that the embedded javascript in that &lt;iframe&gt; executes properly and calls <code>postMessage</code> with the correct values.</p>
  
  <p>I get this error message in Chrome:  </p>
  
  <blockquote>
    <p>Unable to post message to <em>A</em>.
    Recipient has origin <em>B</em>.</p>
  </blockquote>
  
  <p>Here's the code that registers a message event listener in the page on A:</p>
  
  <pre><code>window.addEventListener(
    "message",
    function (event) {
      // Do something
    },
    false);
  </code></pre>
  
  <p>I've also tried calling <code>window.postMessage(some_data, '*')</code>, but all that does is suppress the error.</p>
  
  <p>Am I just missing the point here, is window.postMessage(...) not meant for this?  Or am I just doing it horribly wrong?</p>
  
  <p><sub>*Mime-type text/html, which it must remain.</sub></p>