Function: validateOrigin()

function validateOrigin(
   event, 
   expectedOrigin, 
   expectedSource?, 
   strict?): boolean;

Validate that a MessageEvent originates from the expected origin and source window.

Validation rules:

1. event.origin MUST equal expectedOrigin (exact string match).
2. event.source MUST be the expected iframe contentWindow reference.

Origin validation is mandatory on every incoming message handler.

Parameters

Parameter	Type	Default value	Description
event	MessageEvent	undefined	The raw MessageEvent from the window.addEventListener('message', ...) handler.
expectedOrigin	string	undefined	The exact origin string the iframe was loaded from (e.g. "https://maps.mapsted.com").
expectedSource	Window | null	null	The iframe's contentWindow reference. When null, only origin is checked (useful during init before the iframe reference is available).
strict	boolean	true	When true (current default), throws MAPSTED-1400 on any mismatch. When false, logs a warning and returns false. Internal API callers (emitter, migration shim) that need to continue processing after a mismatch pass false explicitly.

Returns

boolean

true if the event passes all checks; false otherwise (non-strict only).

Throws

MAPSTED-1400 in strict mode on mismatch (redactInProduction: ["expected"]).

Deprecated

Since 4.0.1. Prefer validateOriginWithConfig which accepts the public SecurityConfig contract, supports a multi-origin whitelist + additionalOrigins, and throws MAPSTED-1303 (ERR_SECURITY_CONFIG_ORIGIN_MISMATCH) in strict mode. This single-origin function is retained for backwards compatibility and will be removed in a future major version.