Looking at the current draft for cross document messaging<http://www.w3.org/html/wg/html5/#crossDocumentMessages>, I was wondering if there is any guidance on the scope for postMessage. Specifically, does the postMessage send data across tab/process boundaries? (If there is guidance here in an updated draft I apologize, can't seem to find it!)
Here are a few arguments/counter-arguments that come to mind... * Against allowing this: Limiting it to the same Tab would make it equivalent to IFRAM hack in IE functionality wise.( http://tagneto.blogspot.com/2006/06/cross-domain-frame-communication-with.html) o It would drastically reduce our attack surface without reducing its usefulness too much. * For allowing this: Granted it would be even more powerful if we allow postMessage to go across thread/process boundary. Ensuring this feature is consistent with other DOM reach-ability will be architecturally sound. If a web developer can set window.location on a given target, being able to post a message to it would make sense. I'm excited to hear thoughts here! -- Sunava Dutta Program Manager (AJAX) - Developer Experience Team, Internet Explorer One Microsoft Way, Redmond WA 98052 TEL# (425) 705-1418 FAX# (425) 936-7329
