Merge pull request #4006 from diego0020/patch-1

Verify message comes from loginIframe

adapters/oidc/js/src/main/resources/keycloak.js

@@ -832,9 +832,10 @@
             document.body.appendChild(iframe);
 
             var messageCallback = function(event) {
-                if (event.origin !== loginIframe.iframeOrigin) {
+                if ((event.origin !== loginIframe.iframeOrigin) || (loginIframe.iframe.contentWindow !== event.source)) {
                     return;
                 }
+                
 
                 if (event.data != "unchanged") {
                     kc.clearToken();