[whatwg] Should DOM storage objects be mapped by an "effective script origin" rather then just an "origin"?
Ian Hickson
ian at hixie.ch
Thu Jun 11 13:11:09 PDT 2009
On Tue, 26 May 2009, Honza Bambas wrote:
>
> See also mozilla bug https://bugzilla.mozilla.org/show_bug.cgi?id=494799
>
> Effective script origin driven by document.domain is used to allow
> sharing of properties and data among pages coming from different
> subdomains. Should this "data sharing" apply also to sessionStorage and
> localStorage? It means: having page load from http://test.mysite.com
> accessing sessionStorage would get sessionStorage bound to
> http://test.mysite.com. When that same page than changes document.domain
> to http://mysite.com, sessionStorage it gets now should be a different
> object, bound to http://mysite.com. A reason to do this is also because
> of security checking. The subject's origin changes to http://mysite.com
> and access to sessionStorage bound to http://test.mysite.com should not
> be allowed (origins are not equal).
On Tue, 26 May 2009, Anne van Kesteren wrote:
>
> I'd rather not leak document.domain leak more than necessary. Especially
> with it being bound to the Public Suffix List. If you want to
> communicate across origins you can always use postMessage().
On Tue, 26 May 2009, Jonas Sicking wrote:
>
> I definitely don't see a reason to leak document.domain hacks more than
> neccesary. Further, generally the document.domain feature requires that
> two pages set document.domain to the same value in order to communicate.
> If localStorage was affected by document.domain, that would mean that
> foo.example.com could read example.coms data without example.com ever
> opting in to this.
Based on the above comments I haven't changed the spec. You can work
around this limitation by having an iframe in the other origin and using
postMessage() to communicate with it to manipulate the other storage area.
--
Ian Hickson U+1047E )\._.,--....,'``. fL
http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,.
Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
More information about the whatwg
mailing list