secure onMessage & onResponse