
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
interframe
Advanced tools
Communication made easy between browser frames.
Interframe provides a factory function that takes a window and an origin
to open a communication channel. Please provide the window object of the
counterpart frame to open a communication channel with that frame.
import interframe from "interframe"
/* get reference to iframe */
const iframe = document.getElementById("myIframe")
const channel = interframe(iframe.contentWindow, "*")
Using * as origin allows communication with every other message provider.
Inside of the iframe you can open the channel via
const channel = interframe(window.top)
All communication data are stored in memory as long as the handshake is not done. As soon as the handshake is done the data are sent through the channel.
Interframe allowes to add message event listeners to receive messages from the opposite side. As long as no message listener for the specific namespace is assigned messages are cached.
channel.addListener("namespace", (message) =>
{
console.log(message.id)
console.log(message.namespace)
console.log(message.data)
console.log(message.channel)
})
A message consist of a namespace and, optional, a serializable object.
channel.send("namespace", { foo: "bar" })
As each message has a unique id interframe is able to response to messages.
For this the send() method returns a promise that is resolved with a message.
If response channel is not opened inside message callback the promise is rejected.
const channel1 = interframe(window, "*")
const channel2 = interframe(window, "*")
channel1.addListener("my namespace", (message) =>
{
const responseChannel = message.open()
setTimeout(() =>
{
responseChannel.response({
hello: `Hi ${message.data.username}`
})
}, 1000)
})
channel2
.send("my namespace", { username: "Sebastian" })
.then((message) =>
{
console.log(message.id)
console.log(message.namespace)
console.log(message.data)
console.log(message.channel)
})
response() is a shortcut of send with preset namespace of source message.
function interframe(targetWindow, [origin = "*"])
returns
{
addListener,
removeListener,
send,
hasHandshake
}
This factory function returns a channel.
function addListener(namespace, callback)
returns
callback
Add callback for new messages. callback is a function with the signature
(message) => {}
function removeListener(callback)
Disconnect specific callback from message events.
function send(namespace, [data])
returns
Promise<message>
Send message to opposite side. namespace is a string that defines the type
of the message. data is an optional argument that must be serializable by
JSON.stringify.
The returned message consists of
{
id,
data,
namespace,
response,
}
The promise only resolves if the response()function of the message inside addListener callback is used.
function hasHandshake([callback])
returns
boolean
Returns if handshake is successfull. An optional callback is called as soon as there is a handshake.
Copyright 2016-2019
Sebastian Software GmbH
FAQs
postMessage web api based lightweight interframe communication layer
The npm package interframe receives a total of 37 weekly downloads. As such, interframe popularity was classified as not popular.
We found that interframe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.