Skip to content

Add content script noScriptStartedPostMessage option.#2265

Open
jviney wants to merge 1 commit intowxt-dev:mainfrom
jviney:add-content-script-noScriptStartedPostMessage-option
Open

Add content script noScriptStartedPostMessage option.#2265
jviney wants to merge 1 commit intowxt-dev:mainfrom
jviney:add-content-script-noScriptStartedPostMessage-option

Conversation

@jviney
Copy link
Copy Markdown
Contributor

@jviney jviney commented Apr 14, 2026

Overview

The deprecated window.postMessage path for the wxt:content-script-started message causes bad interactions with sites that have a poorly implemented event listener. Eg a previously dormant event listener like this is now triggered to become an infinite loop of message passing:

window.addEventListener("message", (event) => {
  event.source.postMessage("something")
})

This PR adds an option to exclude the window.postMessage event entirely, until such time as WXT completely removes it, which is a breaking change.

There are two recent PRs that discuss the move away from window.postMessage to custom events.
#1938
#2035

Manual Testing

Checked the postMessage is no longer sent to the window.

Simple reproduction of the issue:

<!DOCTYPE html>
<html lang="en">
<head>
    <script>
      window.addEventListener("message", (e) => {
        console.log("GOT MESSAGE", e, e.detail)
        e.source.postMessage("Hello from the message handler!", "*")
      })
    </script>
    <title>Hello World</title>
</head>
<body>
    <h1>Hello, World!</h1>
</body>
</html>

@jviney jviney requested a review from aklinker1 as a code owner April 14, 2026 00:40
@netlify
Copy link
Copy Markdown

netlify bot commented Apr 14, 2026

Deploy Preview for creative-fairy-df92c4 ready!

Name Link
🔨 Latest commit 280df61
🔍 Latest deploy log https://app.netlify.com/projects/creative-fairy-df92c4/deploys/69dd8cf8f8d78f00088b070e
😎 Deploy Preview https://deploy-preview-2265--creative-fairy-df92c4.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions github-actions bot added the pkg/wxt Includes changes to the `packages/wxt` directory label Apr 14, 2026
The deprecated `window.postMessage` path for the `wxt:content-script-started` message causes bad interactions with sites that have a poorly implemented event listener.

This PR adds an option to exclude the `window.postMessage` event entirely, until such time as WXT completely removes it, which is a breaking change.

Related PRs
wxt-dev#1938
wxt-dev#2035
@jviney jviney force-pushed the add-content-script-noScriptStartedPostMessage-option branch from 4319253 to 280df61 Compare April 14, 2026 00:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg/wxt Includes changes to the `packages/wxt` directory

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant