Cross-Site Tracing is a particularly elaborate vulnerability that, like cross-site scripting, involves the ability to move data between different origins (essential between different web sites, within the context of this article) in an exploitative way that bypasses controls intended to prevent such transfer.

In this article, we take a look at the security model that the Web Messaging API (a.k.a. “Cross-Document Messaging”) – is built on, why the security measures that it introduces are necessary, and some of the potential mis-configurations that can undermine the API’s security model.