# Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com')

**Code:** `Failed to execute postMessage` · **Category:** Browser · **Seen on:** Chrome, Firefox, Safari, JavaScript

`window.postMessage()` was sent with a `targetOrigin` that differs from the receiving window's real origin, so the message is dropped.

## Meaning

`postMessage(data, targetOrigin)` delivers only if the receiver's origin equals `targetOrigin`. Frames that redirect, use `www`/non-`www`, http vs https, or different ports will not match. Use the exact origin of the receiving frame (never `"*"` for sensitive data) and check `event.origin` on the receiving side.

## Common causes

- Wrong scheme, host or port in `targetOrigin` (http vs https, www vs non-www)
- Iframe navigated or redirected to another origin
- Sending before the iframe has loaded
- Using `window.location.origin` for a cross-site recipient
- Popup closed or replaced

## Quick fix

1. Send to the receiver's exact origin (read it from the iframe `src` or a handshake message)
2. Wait for the iframe `load` event before posting
3. Validate `event.origin` and the message format when receiving

## Detailed fix by platform

### JavaScript

1. Sender: `iframe.contentWindow.postMessage({type:'init'}, 'https://widget.example.com');` Receiver: `addEventListener('message', e => { if (e.origin !== 'https://app.example.com') return; /* ... */ });`

## How to diagnose

1. **Origins** — Sender target vs receiver actual origin?
2. **Redirects** — Did the frame redirect?
3. **Timing** — Frame loaded?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/browser/postmessage-target-origin-mismatch)