JavaScript Internals (521 Qs)•Part 6: Async Internals, Memory, Microtasks & Web APIs (329 - 403)
Can I avoid using postMessages completely
You cannot avoid using postMessages completely(or 100%). Even though your application doesn’t use postMessage considering the risks, a lot of third party scripts use postMessage to communicate with the third party service. So your application might be using postMessage without your knowledge.
Practical Code Example
javascript
// Can you avoid postMessage?
// If communicating cross-origin between tabs/iframes, postMessage is the ONLY secure browser mechanism.
// For same-origin communication, you can use BroadcastChannel or Web Locks API:
const channel = new BroadcastChannel('app_updates');
channel.postMessage({ status: 'user_logged_in' });