Security First
Built-in origin validation, message sanitization, and DoS prevention. Production-ready security out of the box.
Type-safe, robust framework for window, tab, and iframe communication
import { Parley, SYSTEM_EVENTS } from 'parley-js';
// Parent window
const parley = Parley.create({
allowedOrigins: ['https://child.example.com'],
timeout: 5000,
});
// Connect to iframe
const iframe = document.getElementById('myFrame');
await parley.connect(iframe.contentWindow, 'child');
// Send message and wait for response
const response = await parley.send(
'getData',
{ id: 123 },
{
targetId: 'child',
}
);
console.log('Response:', response);// Child iframe
const parley = Parley.create({
allowedOrigins: ['https://parent.example.com'],
});
// Handle incoming messages
parley.on('getData', async (payload, respond) => {
const data = await fetchData(payload.id);
respond({ success: true, data });
});
// Connect to parent
await parley.connect(window.parent, 'parent');ParleyJS simplifies the postMessage API with a clean, type-safe interface. It handles the complexity of cross-window communication so you can focus on building features.
Before ParleyJS:
// Complex origin validation
window.addEventListener('message', (event) => {
if (event.origin !== 'https://trusted.com') return;
// Manual message routing
if (event.data.type === 'getData') {
// Handle request
const response = { id: event.data.id, data: result };
// Send response back
event.source.postMessage(response, event.origin);
}
});With ParleyJS:
parley.on('getData', async (payload, respond) => {
const result = await fetchData(payload.id);
respond({ success: true, data: result });
});