iframe cross domain messaging with jQuery postMessage plugin

Question

I am trying to communicate between a child iframe and its parent using the following plugin:

http://benalman.com/projects/jquery-postmessage-plugin/

I can follow the example and post a message from the child to the parent but not the other way and i really need to be able to communicate both ways.

The code on the parent is as follows:

var origin = document.location.protocol + '//' + document.location.host,
    src = origin + '/Custom/Ui/Baseline/html/iframe-data-cash.htm#' + encodeURIComponent(document.location.href);

$(function () {

    var $holder = $('#iframe'),
        height,
        $iframe = $('<iframe src="' + src + '" id="data-cash-iframe" width="100%" scrolling="no" allowtransparency="true" seamless="seamless" frameborder="0" marginheight="0" marginwidth="0"></iframe>');

    // append iframe to DOM
    $holder.append($iframe);

});

$(window).load(function () {
    $.postMessage(
        'hello world',
        src,
        parent.document.getElementById('data-cash-iframe').contentWindow
    );
});

And the code on the child is as follows:

$(function () {

    var parentURL = decodeURIComponent(document.location.hash.replace(/^#/, ''));

    $.receiveMessage(
        function (e) {
            alert(e.data);
        },
        parentURL
    );

});

I really cannot see why this is not working and am in desperate need of help!

Answer 1

Never used that plugin, can't really say what's wrong with it, but, alternately you can use HTML 5 postMessage.

Since you want to send data to the iframe, register an event listener on it:

window.addEventListener('message', receiver, false);

function receiver(e) {
   if (e.origin == '*') {
     return;
   } else {
     console.log(e.data);
   }
}

Be sure to check origin against your trusted domain to prevent damage, instead of "*" which will accept all.

Now you can call

message = "data";
iframe = document.getElementById('iframe');  
iframe.contentWindow.postMessage(message, '*');    

Again, you should change "*" with the destination domain.