Nrthugu

I have developed an app that can be embedded through an iframe in any website. The user gets a script that creates a button similar to (intercom, drift ...) and when it is clicked the iframe is appended to the page and then opened as a modal. The widget accepts personal information and processes a payment via Stripe. All the information is inputted in the iframe and not transmitted from the parent page.

Inside the modal, there is a close[x] button, when clicked the modal gets hidden through a postMessage event sent to the parent page.

// inside iframe

$('#CloseModal').on('click', function() {

   parent.postMessage({ hide: 'hide-modal'}, '*');

});



// in parent page

var modal = document.getElementById('#IframeModal');

window.onmessage = function(msg) {

   if (msg.data.hide === 'hide-modal') {

      modal.style.display = 'none';

   }

};

I cannot set the origin domain since is very hard to control the exact domain on which the user is going embed the widget. The only reason I need to send messages between the iframe and parent is for the user to be able to close the modal from within the iframe.

My question is if that is the only message sent from iframe to the parent and there will be no other messages sent from the parent to iframe, what kind of security am I exposing myself or the client website to?

Note: I have done a lot of research and I couldn't find any specific information in regards to my question.