[whatwg] proposal for a location.domain property
bzbarsky at MIT.EDU
Thu May 24 14:49:58 PDT 2012
On 5/24/12 5:02 PM, Maciej Stachowiak wrote:
> I agree. Even though there are still legacy features like cookies and document.domain that use domain-based security, most of the Web platform uses origin-based security
For security, yes.
But for, say, resource limits, one wants to use domain-based limits
because otherwise limits are easily worked around using subdomains. At
least that's the way we try to do it in Gecko.
Looking at our (Mozilla's) internal uses of getBaseDomain(), it's used for:
* various site identity UI bits (e.g. highlighting the TLD+1 in the URL
bar, the thing to show as the site identifier in various prompts, and
* something about deciding whether to send CSP error reports
* "third-party" determination (mostly cookies again, I suspect)
* document.domain setting
* Clearing "per-site" plugin data (see cookies)
* localStorage quota enforcement
* Something with caps on number of concurrent DOM workers
* The URL bar autosuggest implementation
I agree that it's not entirely clear how much of this is relevant to the
web at large. Web apps that need this functionality (e.g. the browser
in B2G) _can_ always import the eTLD list, if forced to....
More information about the whatwg