I have a use case where I need to accept javascript from users of my app and evaluate it using eval. I figured the 'safe' way would be to use web workers inside of a sandboxed iframe.

I found this article in my research, following which I was able to successfully send code to my web worker and get the eval response back to my main app.

targetOrigin while sending code to the iframe was * (because I don't have allow-same-origin and the iframe's window.origin would be null)."

I was wondering if there's any other alternative rather than enabling the allow-same-origin on my iframe OR setting * as both of them pose some sort of security issues which more or less mitigate the advantages of using the sandboxed iframe in first place (from what I read online).

Thank you

PS. I did find other SO threads that discuss this issue but none were addressed/came to a conclusion so was looking for a fresh perspective. I am pasting the URL below for the interested members.

javascript - postMessage to sandboxed iframe, why is recipient window origin null?