Locker Service: Why secure communication using addEventListener() and postMessage() between iframes is crippled?

Question

I need to implement secure communication between Visualforce embedded on a Lightning Component. The LC sits on a Flexipage.

One of my goals is, that the VF-page sends it's actual height to the LC so that the LC can adjust the height of the iframe. Fixed heights are always killing UX. But many, many other meaningful and painfully needed use cases can be solved using the same secure communication method.

Now without Locker Service the world is fine with this markup:

<aura:handler name="init" value="{!this}" action="{!c.init}" />
<iframe src="/apex/yourVisualforcePageName" width="100%"></iframe>

And this controller:

init : function(cmp, evt, hlp) {
    window.addEventListener("message", elfMessageRouter, false);
    function elfMessageRouter(event) {
        console.log('RECEIVED',event.data);
    }
},

Usage is simple:

window.parent.postMessage( { foo: "bar", height: 123 } ,'*' );

And you get something nice in your console:

RECEIVED Object {foo: "bar", height: 123}

But now comes Locker Service... I go to Setup > Critical Updates and turn that baby on, I change nothing, reload my page in LEX and get only:

RECEIVED Object {}

Which shows that the process works but the parameter is busted.

How this can be optimized? Is this communication method at all accepted or considered as some kind of threat or unwanted feature?

Btw. the fixed-iframe-height was my main pain point for nearly 10 years of Aloha-live... Many have asked for dynamic sized embedding containers on standard layouts - but they never came. Then (out of desperation) we came up with crap like these hacks: Why do we still need to hack the Sidebar? Usecases - Workarounds - Alternatives

How we can do it right now and secure from the beginning?

Answer 1

According to the SecureWindow Locker Service API tests, postMessage is supposed to be supported:

Method      Test Plan (expected)    Browser API (actual)    Locker API (actual)
            Type    Empty   Opaque  Type    Empty           Type    Empty   Opaque
postMessage function                function                function    

Since they're expecting a function, and it states that tests are actually passing at the moment, postMessage should be allowed in the future.

Answer 2

First thing I thought, OK, let's do it with morse-code, then ;-) But no kidding, it works in the current release of Locker Service a little bit better. What I found is that actually I can at least use a string parameter like this:

 window.parent.postMessage( "foobar" ,'*' );

This brings at the receiver this:

RECEIVED foobar

Which is good enough for me to help myself. But looking a bit deeper into my console, I see a string attached. There is a warning by aura_proddebug.js:19408:

WARNING: Error in filesManagerHelper while parsing post message dataSyntaxError: Unexpected token o in JSON at position 1

Does this show only a small glitch in the Locker or is the a bug or an incomplete "feature" which will kill my entire communication eventually?

Will Locker Service allow us a reliable way to make Lightning Experience and Visualforce communicate securely, stable and reliable together? Will Salesforce provide us mechanisms of doing so? Are we allowed to help ourselves? Or is this unwanted at all?