PostMessage from a sandboxed iFrame to the main window, origin is always null
<p>There's something I don't get about the event origin with javascript postMessage event.</p>

<p>Here is my main page:</p>

<pre><code>&lt;html&gt;
&lt;body&gt;

&lt;h1&gt;Test&lt;/h1&gt;
&lt;h2&gt;Outside&lt;/h2&gt;

&lt;iframe src="iframe-include.html" 
    width="100%" height="100" 
    sandbox="allow-scripts"&gt;&lt;/iframe&gt;

&lt;script type="text/javascript"&gt;
window.addEventListener('message', function (event) {
    console.log(event);
}, false);
&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>And my iFrame content</p>

<pre><code>&lt;html&gt;
&lt;body&gt;

&lt;h3&gt;Inside&lt;/h3&gt;

&lt;script type="text/javascript"&gt;
var counter = 1,
    domain = window.location.protocol + '//' + window.location.host,
    send = function () {
        window.setTimeout(function () {
            console.log('iframe says:', domain);
            window.parent.postMessage(counter, domain);
            counter += 1;
            send();
        }, 3000);
    };

send();
&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>Looking at the console, the origin property of the event object is always null, even if the domain variable in the iFrame is correct.</p>

<p>My console says:</p>

<pre><code>iframe-include.html:11 iframe says: http://127.0.0.1:8181
iframe.html:11 MessageEvent {isTrusted: true, data: 2, origin: "null", lastEventId: "", source: Window…}
</code></pre>

<p>In every doc, it says that it's important to check on event.origin inside de "message" event listener. But how to do that if it's always null?</p>

<p>Thanks for the help</p>