require-post-message-target-origin.md

Enforce using the targetOrigin argument with window.postMessage()

When calling window.postMessage() without the targetOrigin argument, the message cannot be received by any window.

This rule cannot distinguish between window.postMessage() and other calls like Worker#postMessage(), MessagePort#postMessage(), Client#postMessage(), and BroadcastChannel#postMessage(). Use on your own risk.

Fail

window.postMessage(message);

Pass

window.postMessage(message, 'https://example.com');

window.postMessage(message, '*');