# Cross-Origin Messaging for Embedded Browser Components

DevFeed: [Cross-Origin Messaging for Embedded Browser Components](<https://devfeed.tech/articles/post-message-19441.md>)

Original publisher: [Read original article](<https://www.codenameone.com/blog/post-message/>)

Author: Shai Almog

Published: 2019-06-17T00:00:00Z

Content type: tutorial

Language: en

Sources: [CodeName One](<https://devfeed.tech/sources/codename-one.md>)

Topics: [Cross-origin resource sharing (CORS)](<https://devfeed.tech/topics/cors.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [cors](<https://devfeed.tech/tags/cors.md>), [javascript](<https://devfeed.tech/tags/javascript.md>)

## AI overview

The article explains how the same-origin policy and CORS affect communication with an embedded browser component from another domain. It describes using message sending and a web-page message event listener to enable communication between the two origins.

## Source excerpt

BrowserComponent is a pretty powerful tool when you just want to integrate HTML into your application. We use it a lot in native apps, but surprisingly it's just as useful when we compile an app as a web application. It lets us embed HTML into the web application. But there's a big caveat known as SOP when we do that. SOP and CORS SOP is the "Same Origin Policy" enforced by browsers. It prevents CSRF (Cross Site Request Forgery) which essentially lets a site pretend it's a different site.