adding support of array for checkOrigin parameter of iframeResizer

README.md

@@ -82,9 +82,9 @@ Override the default body margin style in the iFrame. A string can be any valid
 ### checkOrigin
 
 	default: true
-	type:    boolean
+	type:    boolean || array
 
-When set to true, only allow incoming messages from the domain listed in the `src` property of the iFrame tag. If your iFrame navigates between different domains, ports or protocols; then you will need to disable this option.
+When set to true, only allow incoming messages from the domain listed in the `src` property of the iFrame tag. If your iFrame navigates between different domains, ports or protocols; then you will need to provide an array of domains or disable this option.
 
 ### enableInPageLinks
 

src/iframeResizer.js

@@ -166,20 +166,39 @@
 			messageData[dimension]=''+size;
 		}
 
+		function checkAllowedOrigin(origin,checkOrigin,remoteHost){
+			function checkList(){
+				log(' Checking connection is from list of origins: ' + checkOrigin);
+				var i;
+				for (i = 0; i < checkOrigin.length; i++) {
+					if (checkOrigin[i] === origin) {
+						return true;
+					}
+				}
+				return false;
+			}
+
+			function checkSingle(){
+				log(' Checking connection is from: '+remoteHost);
+				return origin == remoteHost;
+			}
+
+			return checkOrigin.constructor === Array ? checkList() : checkSingle();
+		}
+
 		function isMessageFromIFrame(){
 			var
 				origin     = event.origin,
 				remoteHost = messageData.iframe.src.split('/').slice(0,3).join('/');
 
-			if (settings[iframeID].checkOrigin) {
-				log(' Checking connection is from: '+remoteHost);
-
-				if ((''+origin !== 'null') && (origin !== remoteHost)) {
+			var checkOrigin = settings[iframeID].checkOrigin;
+			if (checkOrigin) {
+				if ((''+origin !== 'null') && !checkAllowedOrigin(origin,checkOrigin,remoteHost)) {
 					throw new Error(
 						'Unexpected message received from: ' + origin +
 						' for ' + messageData.iframe.id +
 						'. Message was: ' + event.data +
-						'. This error can be disabled by adding the checkOrigin: false option.'
+						'. This error can be disabled by adding the checkOrigin: false option or providing of array of trusted domains.'
 					);
 				}
 			}