PostMessage is showing access denied error after sprint 19 update in edge and firefox

Question

I am using Postmessage described in this post https://developer.salesforce.com/blogs/developer-relations/2017/01/lightning-visualforce-communication.html

to communicate between vf page and lighting component it was working fine after 19 updates it is showing access denied error on load

component.xml

<aura:attribute name="vfHost" type="String" default="sonicsyed--c.ca15.visual.force.com'}"/>
<!-- The Visualforce page to send data to -->
<iframe aura:id="vfFrame" width='100%' height="{!v.iframeHeight +'px;'}" src="{!'https://' + v.vfHost + '/apex/VF_RichText'}" onload="{!c.onload}" style="border:0px" />

component.js

   let vfOrigin = "https://" + component.get("v.vfHost");
    let vfWindowComp = component.find("vfFrame");

    if(vfWindowComp){
        let vfWindow=vfWindowComp.getElement().contentWindow;
        vfWindow.postMessage('hi', vfOrigin);    
    }

VF_RichText.vfp

var lexOrigin = "https://sonicsyed.lightning.force.com";
window.addEventListener("message", function(event) {
    //console.log(event.origin);
    //console.log(event.data);
    if (event.origin !== lexOrigin) {
        // Not the expected origin: reject message!
        return;
    }
    // Handle message
    if(!event.data){
        return;
    }

    let cotainerData=event.data;
});

Answer 1

I am facing this same issue. Post Spring '19 I am getting Permission Denied error in Edge when doing PostMessage from Lightning Component. I have raised a SF case for this and waiting to hear back from Salesforce. In the mean time if you get any solution please let us know.

Found this Known Issue : https://success.salesforce.com/issues_view?title=postmessage-is-not-a-valid-function-in-salesforce-app-and-safari-browser&Id=a1p3A000001RX49

Answer 2

After a long Fight with salesforce spring 19 documentation, I resolved this in chrome and firefox, Did not try this in edge

1. Goto setup
2. goto session settings
3. under whitelisting domains Add 2 domain names
4. One as --c..visual.force.com
5. One as .lightning.force.com"
6. save

Adding only one will not do the trick as post message is 2-way communication both domains are to be whitelisted