[whatwg] `window.location.origin` in sandboxed IFrames.

Anne van Kesteren annevk at annevk.nl
Thu Jan 10 04:13:30 PST 2013


On Thu, Jan 10, 2013 at 12:17 AM, Mike West <mkwst at google.com> wrote:
> Adam explained that WebKit currently treats the 'origin' attribute as
> the origin of the document's location, not the origin of the
> document[1]. This is generally benign, but surprised me in the
> sandboxed case.
>
> What should the expected behavior in this case be? Given the way that
> MessageEvent sets the origin of a message from a sandboxed frame to
> the string "null", that seems like a reasonable option here as well.
>
> WDYT?
>
> [1]: https://bugs.webkit.org/show_bug.cgi?id=106488#c1

Given that location.origin is defined by http://url.spec.whatwg.org/
once the dust of integrating URL into HTML settles, having
URLUtils.origin reflect the Document's origin when URLUtils is
implemented by Location would be very weird.

If you want the origin of a Document we could introduce
Document.origin I suppose.


-- 
http://annevankesteren.nl/



More information about the whatwg mailing list