[whatwg] proposal for a location.domain property

[Boris Zbarsky]

On 5/24/12 5:02 PM, Maciej Stachowiak wrote:
> I agree. Even though there are still legacy features like cookies and document.domain that use domain-based security, most of the Web platform uses origin-based security

For security, yes.

But for, say, resource limits, one wants to use domain-based limits 
because otherwise limits are easily worked around using subdomains.  At 
least that's the way we try to do it in Gecko.

Looking at our (Mozilla's) internal uses of getBaseDomain(), it's used for:

* cookies
* various site identity UI bits (e.g. highlighting the TLD+1 in the URL
   bar, the thing to show as the site identifier in various prompts, and
   so forth)
* something about deciding whether to send CSP error reports
* "third-party" determination (mostly cookies again, I suspect)
* document.domain setting
* Clearing "per-site" plugin data (see cookies)
* localStorage quota enforcement
* Something with caps on number of concurrent DOM workers
* The URL bar autosuggest implementation

I agree that it's not entirely clear how much of this is relevant to the 
web at large.  Web apps that need this functionality (e.g. the browser 
in B2G) _can_ always import the eTLD list, if forced to....

-Boris