bidc

accepts any incoming message as long as the matches — it never checks where the message came from. Since the default is and any window with a handle to the target (opener, parent, named frame) can to it, a malicious window that knows or guesses the can complete the handshake and hijack a legitimate channel, intercepting all subsequent communication. A possible fix is to add an optional argument to . When provided: Inbound: connections whose differs from the declared origin are rejected in . Outbound: the origin is used as the for instead of , so handshake messages aren't broadcast to other origins. The expected origin has to be declared by the caller — it can't be derived from a cross-origin target ( throws a ), and deriving it from the first handshake (trust-on-first-use) is a race an attacker can win, so it wouldn't actually be safe. Fully backward compatible: without origin, behaviour is identical to before.

Can I use this to communicate with a service worker from the main thread? If so, how?

visit example.com, open devtools, paste and run - demo works Such an html file in the project, set up GitHub pages, and you get a playground for playing with this without having to load/install anything locally, could be useful