What is the postMessage / onmessage pattern? Is communication synchronous or asynchronous?

0-2 years experience

1. 1You need to send a simple string from an iframe to its parent page using postMessage. How would you set it up, and what do you need to check on the receiving side?
2. 2If the parent page receives a message but the onmessage handler never fires, what are common reasons and how would you debug it?
3. 3What’s the difference between specifying '*' versus a specific origin in the targetOrigin argument?

2-5 years experience

1. 1We have a web app that loads third‑party widgets in iframes and they need to exchange data via postMessage. One widget sometimes receives stale data. Walk me through how you’d investigate and what async nature of postMessage could affect this.
2. 2During a refactor we moved the message listener into a shared utility module, and now some messages are lost. Explain why that might happen and what ordering guarantees postMessage provides.
3. 3Explain the trade‑offs between using postMessage and a shared worker for cross‑origin communication in terms of latency and security.

5-8 years experience

1. 1Design a robust messaging layer between the main window and multiple sandboxed iframes that need to handle high‑frequency events. How would you ensure ordering, avoid race conditions, and keep the communication asynchronous without blocking the UI?
2. 2Our application must support fallback for browsers that don’t support postMessage. How would you architect a polyfill that preserves async behavior and what performance implications would you consider?
3. 3If you need to broadcast a message to dozens of embedded iframes and guarantee delivery within 100 ms, what patterns or optimizations would you apply, and how does the async nature of postMessage influence your design?

8+ years experience

1. 1We’re migrating a legacy monolith that uses custom URL‑hash polling for cross‑frame communication to postMessage. What architectural changes, testing strategies, and backward‑compatibility concerns would you address at a company‑wide level?
2. 2Across several teams, different conventions for message payloads and origin checks have caused security incidents. How would you establish a unified contract and governance model for postMessage usage across the organization?
3. 3Consider a SaaS platform that embeds customer‑hosted widgets on arbitrary domains. How would you design a secure, scalable postMessage protocol that can evolve over time without breaking existing integrations?