BroadcastChannel is an origin-scoped bus, not an authorization channel
The browser BroadcastChannel API lets same-origin browsing contexts send messages to one another. The HTML Standard defines message delivery through structured serialization and a source storage key. The API is a convenient way to synchronize a tab, a worker, and a page. It is not a way to decide whether a message sender is allowed to perform an action.
Every listener should assume that another script in the same origin or storage partition can post a message. The page's origin remains the main browser boundary. If one part of the origin runs untrusted third-party code, or if different applications share a domain, the bus may connect code that the application mentally keeps separate.
Treat messages as input from a peer
The browser delivers the message data to each destination as a structured clone. Cloning prevents shared object references, but it does not authenticate the sender or preserve a trusted JavaScript identity. A field named role or internal is just data.
Define a message schema with a version, a message type, and bounded fields. Reject unknown types. Validate lengths and enum values before acting. If the action changes stored state, apply the same server-side authorization and origin checks that protect a normal network request. A privileged action should not become reachable simply because it arrived over a same-origin channel.
Use a random channel name per tenant or session when separation is required. A predictable name is discoverable by any code that can run in the same origin and partition. For sensitive flows, include a per-session nonce and verify it against server-issued state. Do not send bearer tokens or long-lived secrets unless the product's threat model explicitly accepts that exposure.
Understand the partition
The standard derives a source storage key when a broadcast is sent. Browser storage partitioning can change which contexts share a channel. Test the actual deployment in a first-party tab, an embedded frame, a worker, and a private browsing context. A flow that works in the top-level page may not receive messages in an iframe with a different storage partition.
The message event carries an origin value. That is useful for diagnostics and for rejecting unexpected contexts when the browser exposes them, but it does not replace application authorization. Verify the source when the platform supplies a meaningful source. Keep the receiver's policy in the receiving script or, where privileges matter, on the server.
Close channels when they are no longer needed. The HTML Standard notes that objects with listeners can stay alive until the page or worker closes. A leaked channel may remain reachable longer than its intended feature.
Test the adversarial sequence
Open two contexts in the same origin and send a malformed message, an unknown version, a message with oversized fields, and a message claiming a privileged role. Confirm that the receiver rejects each one before changing state. Repeat the test after a same-origin navigation and after a worker restart. Verify that old session nonces no longer work.
BroadcastChannel provides low-latency coordination with little setup. Treat it as a local event bus with a clear schema and a narrow privilege surface. The authorization decision still belongs with the resource, not with the bus.
