Skip to content

Changing the Origin-Agent-Cluster default, aka deprecating document.domain #601

@otherdaniel

Description

@otherdaniel

Request for Mozilla Position on an Emerging Web Specification

This would be a modification to https://html.spec.whatwg.org/multipage/origin.html#origin-isolation, specifying that an absent (or malformed) header is to be treated like the ?1 case. Plus corresponding editorial changes in create and initialize a Document object. This has the effects of:

  1. Turning Origin-Agent-Cluster: from an opt-in into an opt-out mechanism.
  2. Modifying usage of document.domain to relax same-origin restrictions becomes an opt-in feature. (You'd have to explicitly set Origin-Agent-Cluster: ?0to keep using it.)
  3. WIth origin-keyed agent clustering being allowable by default, browsers should be able to origin-isolate many more pages. (Or at least, have document.domain no longer be in the way.)

Other information

TAG discussion on the subject: w3ctag/design-reviews#564
HTML Spec on Origin-Agent-Cluster: https://html.spec.whatwg.org/multipage/origin.html#origin-isolation
HTML Spec on document.domain: https://html.spec.whatwg.org/#relaxing-the-same-origin-restriction
HTML Spec on initialising a document: https://html.spec.whatwg.org/multipage/browsing-the-web.html#initialise-the-document-object

Chromium plans to issue a deprecation warning for mutating document.domain soon-ish, with the goal of paving the way for this.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions