content-security-policy/support/postmessage-fail.html

<script>
    window.parent.postMessage('FAIL', '*');

</script>