title: postMessage giving "Blocked frame" error, but only in Safari
body: <p>I am using postMessage to share data between <a href="https://www.example.com" rel="nofollow noreferrer">https://www.example.com</a> (Which I'll call mainSite) and <a href="https://subdomain.example.com" rel="nofollow noreferrer">https://subdomain.example.com</a> (which I'll call subSite)</p>
  
  <p>subSite has an iframe to mainSite, </p>
  
  <p>subSite's code looks something like:</p>
  
  <pre class="lang-js prettyprint-override"><code>//set the src of the iframe
  $("#main-site-iframe").attr("src", "https://www.example.com");
  //wait for the main site page to open
  $("#main-site-iframe")[0].onload = () =&gt; {
      //my page posts a message to their site
      $("#my-iframe")[0].contentWindow.postMessage("messagePlox", "https://www.example.com");  
  };
  
  //wait for the iframe to message back
  window.addEventListener('message', iframeResponse, false);
  function iframeResponse(e) {
      //make sure the request is from the correct site
      if(e.origin == 'https://www.example.com')
      {
          //Got the data
          console.log(e.data);
      }
  }
  </code></pre>
  
  <p>mainSite looks like this:</p>
  
  <pre><code>//listen for the subdomain to make a request
  window.addEventListener('message', subdomainRequest, false);
  function subdomainRequest(e) {
      //make sure the request is from the correct subdomain
      if(e.origin == 'https://subdomain.example.com')
      {
          //respond with the data
          e.source.postMessage("We got you", e.origin);
      }
  }
  </code></pre>
  
  <p>The problem with the above is that it works in every browser EXCEPT Safari which refuses it and says:</p>
  
  <blockquote>
    <p>Blocked a frame with origin "<a href="https://www.example.com" rel="nofollow noreferrer">https://www.example.com</a>" from accessing a frame with origin "<a href="https://subdomain.example.com" rel="nofollow noreferrer">https://subdomain.example.com</a>". Protocols, domains, and ports must match.</p>
  </blockquote>
  
  <p>Which seems to imply the response back is breaking since mainSite is trying to "access" subSite.</p>
  
  <p>Does anyone know why this would only happen in Safari and not in Firefox or Chrome?</p>