title: PostMessage from a sandboxed iFrame to the main window, origin is always null
body: <p>There's something I don't get about the event origin with javascript postMessage event.</p>
  
  <p>Here is my main page:</p>
  
  <pre><code>&lt;html&gt;
  &lt;body&gt;
  
  &lt;h1&gt;Test&lt;/h1&gt;
  &lt;h2&gt;Outside&lt;/h2&gt;
  
  &lt;iframe src="iframe-include.html" 
      width="100%" height="100" 
      sandbox="allow-scripts"&gt;&lt;/iframe&gt;
  
  &lt;script type="text/javascript"&gt;
  window.addEventListener('message', function (event) {
      console.log(event);
  }, false);
  &lt;/script&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And my iFrame content</p>
  
  <pre><code>&lt;html&gt;
  &lt;body&gt;
  
  &lt;h3&gt;Inside&lt;/h3&gt;
  
  &lt;script type="text/javascript"&gt;
  var counter = 1,
      domain = window.location.protocol + '//' + window.location.host,
      send = function () {
          window.setTimeout(function () {
              console.log('iframe says:', domain);
              window.parent.postMessage(counter, domain);
              counter += 1;
              send();
          }, 3000);
      };
  
  send();
  &lt;/script&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Looking at the console, the origin property of the event object is always null, even if the domain variable in the iFrame is correct.</p>
  
  <p>My console says:</p>
  
  <pre><code>iframe-include.html:11 iframe says: http://127.0.0.1:8181
  iframe.html:11 MessageEvent {isTrusted: true, data: 2, origin: "null", lastEventId: "", source: Window…}
  </code></pre>
  
  <p>In every doc, it says that it's important to check on event.origin inside de "message" event listener. But how to do that if it's always null?</p>
  
  <p>Thanks for the help</p>