Add domain check before sending init message to parent about zoid

[bluepnume]

Yeah, the way it stands right now is that components can be rendered by any domain. If you need to restrict this the best way right now is to rely on an X-FRAME-OPTIONS header.

[harouny]

@bluepnume Can you add more info to that item please? What kind of domain check still missing?

[bluepnume]

Hey, the intent of this was to allow components to define which domains they can be rendered by. For example, if a component specified:

parentDomains: [
    'https://a.com',
    'https://b.com'
]

but the component was rendered by https://c.com, the component should error out and not send any init message (or any message) up to the parent.

[harouny]

Cool. Thanks for the info. On that just to confirm, if a component didn't specify parentDomains, it means that it can send messages to any domain.