# Issue with okta\_post\_message responce mode giving error **URL:** \ **Category:** OAuth/OIDC\ **Created:** [November 25, 2022, 11:04am UTC](https://devforum.okta.com/t/issue-with-okta-post-message-responce-mode-giving-error/22555 "2022-11-25T11:04:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![UD1991](https://avatars.discourse-cdn.com/v4/letter/u/4da419/32.png) [@UD1991](https://devforum.okta.com/u/UD1991)\ **Post date:** [November 25, 2022, 11:04am UTC](https://devforum.okta.com/t/issue-with-okta-post-message-responce-mode-giving-error/22555/1 "2022-11-25T11:04:24Z")
we are seeing issue with okta\_post\_message response mode . the URL works fine with query. we re using custom domain in our org. issuer also set to [https://org.abc.com](https://org.abc.com). Both redirect url also in same domain. Below is the URL we are trying on browser and it get struck on the browser not going anywhere. [https://org.abc.com/oauth2/v1/authorize?client\_id=XXXXXXXXcode\_challenge=V-HHH-gYyfW0D\_KlHs11Jp8I50Gg2Oc-ZRPPhiuJKhc&code\_challenge\_method=S256&nonce=SM97kDTYgx6iseSzqirXgcBo0nLXsGvUVWUy4klxban0l8galyb5Da3ZhiCJxjCc&prompt=none&redirect\_uri=https://xyz.abc.com&response\_mode=okta\_post\_message&response\_type=code&state=1sgy4hDgcB6Bl6rOhDvsbMDpF3Dgqw3BBS2uh2KGA86oMs3vDMwLM6TTeeBLcFs6&scope=openid](https://org.abc.com/oauth2/v1/authorize?client_id=XXXXXXXXcode_challenge=V-HHH-gYyfW0D_KlHs11Jp8I50Gg2Oc-ZRPPhiuJKhc&code_challenge_method=S256&nonce=SM97kDTYgx6iseSzqirXgcBo0nLXsGvUVWUy4klxban0l8galyb5Da3ZhiCJxjCc&prompt=none&redirect_uri=https://xyz.abc.com&response_mode=okta_post_message&response_type=code&state=1sgy4hDgcB6Bl6rOhDvsbMDpF3Dgqw3BBS2uh2KGA86oMs3vDMwLM6TTeeBLcFs6&scope=openid) profile Below is the error showing in developer tool. Failed to execute ‘postMessage’ on ‘DOMWindow’: The target origin provided (‘[https://xyz.abc.com](https://xyz.com/)’) does not match the recipient window’s origin [https://org.abc.com](https://org.abc.com/) Did any one faced similar. Please let me know why it’s not working with okta\_post\_message . ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [November 25, 2022, 5:36pm UTC](https://devforum.okta.com/t/issue-with-okta-post-message-responce-mode-giving-error/22555/2 "2022-11-25T17:36:17Z")
When using okta\_post\_message, t is expected/required that the domain making the /authorize redirect should match the one that will receive the authorization code, aka the redirect\_uri, see our docs for reference: > `okta_post_message` is an adaptation of the [Web Message Response Mode](https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1) [(opens new window)](https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1). This value provides a secure way for a single-page application to perform a sign-in flow in a pop-up window or an iFrame and receive the ID token, access token, and/or authorization code back in the parent page without leaving the context of that page. The data object for the `postMessage` call is in the next section. > **Note:** The value of the `targetOrigin` parameter for `postMessage()` specifies what the origin of `parentWindow` must be for the event to be dispatched (this is enforced by the browser). The `okta_post_message` response mode always uses the origin from the `redirect_uri` specified by the client. This is crucial to prevent the sensitive token data from being exposed to a malicious site. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 13, 2024, 12:17am UTC](https://devforum.okta.com/t/issue-with-okta-post-message-responce-mode-giving-error/22555/3 "2024-02-13T00:17:21Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.