Function: validateOriginWithConfig()

function validateOriginWithConfig(
   event, 
   config, 
   expectedSource?): boolean;

Validate an incoming MessageEvent against a SecurityConfig.

This is the public config-driven replacement for the legacy validateOrigin(event, origin, source, strict) signature.

Validation: if (!effectiveWhitelist.includes(event.origin)) { if (strictMode) throw; else warn }

Where effectiveWhitelist = allowedOrigins ∪ additionalOrigins (see getEffectiveWhitelist for the deduplication + order contract).

Parameters

Parameter	Type	Default value	Description
event	MessageEvent	undefined	The raw MessageEvent from the message handler.
config	SecurityConfig	undefined	The resolved SecurityConfig. Callers typically pass the result of resolveConfig at init time, not the raw user-supplied object.
expectedSource	Window | null	null	Optional iframe contentWindow reference to enforce source-window identity. Defaults to null (skip source check).

Returns

boolean

true if the event passes; false on mismatch in non-strict mode.

Throws

MAPSTED-1303 (ERR_SECURITY_CONFIG_ORIGIN_MISMATCH) in strict mode when the origin is not in the effective whitelist.