UA Ledger · Playable Test Bench · draft for review

Reject a lookalike origin before handling a host message

Teaching laboratory. Cases run in this page against the authored functions. This is not a device panel, network approval, analytics-delivery proof or campaign result. Inputs are synthetic.

A playable embedded in a host may receive messages from more than one source. This fixture tests an exact origin boundary rather than accepting any address containing a trusted-looking word.

Primary documentation: MDN: message origin (body read 2026-09-19).

Cases

CaseInputExpectedFixedBroken

What a pass does not prove

Passing this check establishes one part of message validation. A real handler also needs to verify the expected source window and the complete payload shape. An origin alone is not a schema, and a valid message type does not make arbitrary additional data safe or meaningful.