diff --git a/public/js/jsFromMiddleLayer/main.js b/public/js/jsFromMiddleLayer/main.js
index f77f99266..ee0aabb00 100755
--- a/public/js/jsFromMiddleLayer/main.js
+++ b/public/js/jsFromMiddleLayer/main.js
@@ -32,7 +32,7 @@ function openTerminal(options) {
             console.log(data);
             client.sendClientData(data);
 
-            window.parent.postMessage({ tp: 'sshWorking' }, "*");
+            window.parent.postMessage({ tp: 'sshWorking' }, window.location.origin);
         });
         term.open();
         $('body>.terminal').detach().appendTo(parentDomId + ' #term');
@@ -66,6 +66,7 @@ function openTerminal(options) {
         };
 
         window.addEventListener("message", function (event) {
+            if (event.origin !== window.location.origin) return
             console.log("post message: ");
             console.log(event.data);
             if (event.data.tp === 'resize') {
@@ -106,7 +107,7 @@ function openTerminal(options) {
                     }
                     if (force_close_socket === false) {
                         // $(window).trigger('setSSHConnectStatus');
-                        window.parent.postMessage({ tp: 'setSSHConnectStatus', tab: options.tab }, "*");
+                        window.parent.postMessage({ tp: 'setSSHConnectStatus', tab: options.tab }, window.location.origin);
                     } else {
                         // 主动关闭连接时，不自动重连
                         force_close_socket = false;
diff --git a/src/modules/tpm/jupyter/index.js b/src/modules/tpm/jupyter/index.js
index 6883aa72f..47c97627a 100644
--- a/src/modules/tpm/jupyter/index.js
+++ b/src/modules/tpm/jupyter/index.js
@@ -111,7 +111,7 @@ function JupyterTPI (props) {
   const addEventListeners = () => {
     window.addEventListener('message', (e) => {
       // console.log("触发了jupytermessage");
-      if(e){
+      if(e && e.origin === window.location.origin){
         if(e.data){
           if(e.data==="jupytermessage"){
             newHandle()
@@ -127,9 +127,9 @@ function JupyterTPI (props) {
       return;
     }
     if(sum===1){
-      _iframe.contentWindow.postMessage("stopParent", "*");
+      _iframe.contentWindow.postMessage("stopParent", window.location.origin);
     }else{
-      _iframe.contentWindow.postMessage("clonsParent", "*");
+      _iframe.contentWindow.postMessage("clonsParent", window.location.origin);
     }
 
   }
diff --git a/src/modules/tpm/shixunchild/Challenges/Challengesjupyter.js b/src/modules/tpm/shixunchild/Challenges/Challengesjupyter.js
index 391d9aa39..97f42f770 100644
--- a/src/modules/tpm/shixunchild/Challenges/Challengesjupyter.js
+++ b/src/modules/tpm/shixunchild/Challenges/Challengesjupyter.js
@@ -197,7 +197,7 @@ class Challengesjupyter extends Component {
 
 
 		window.addEventListener('message', (e) => {
-			if(e){
+			if(e && e.origin === window.location.origin){
 				if(e.data){
 					if(e.data==="jupytermessage"){
 						if(this.state.showtime===false){