{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/829","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/829/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/829/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/829/events","html_url":"https://github.com/whatwg/html/issues/829","id":139249190,"number":829,"title":"Phasing out document.domain","user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/whatwg/html/labels/needs%20implementor%20interest","name":"needs implementor interest","color":"5319e7"},{"url":"https://api.github.com/repos/whatwg/html/labels/normative%20change","name":"normative change","color":"207de5"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-03-08T11:12:48Z","updated_at":"2016-03-08T19:53:38Z","closed_at":null,"body":"Based on discussion in https://github.com/w3c/webappsec-secure-contexts/issues/10 with @mikewest, @hillbrad, @bholley, and @jwatt, hereby a concrete proposal for how we could phase out document.domain usage for new features:\r\n\r\nFurthestSameOriginBrowsingContext ( _document_ )\r\n\r\n1. Let _start_ be _document_'s browsing context.\r\n1. Let _current_ be _start_.\r\n1. Let _furthest_ be _start_.\r\n1. While _current_ has a parent browsing context:\r\n  1. Set _current_ to _current_'s parent browsing context.\r\n  1. If _current_'s Document object's origin is same origin with _start_'s Document object's origin, set _furthest_ to _current_.\r\n1. Return _furthest_.\r\n\r\nDocumentDomainDisabler ( _document_, _disable_ )\r\n\r\n1. Let _unexpected_ be false, if _disable_ is true, and true otherwise.\r\n1. Let _furthest_ be FurthestSameOriginBrowsingContext(_document_).\r\n1. Let _state_ be _furthest_'s Document object's [[DisableDocumentDomain]] internal slot.\r\n1. If _state_'s value is _unexpected_, then return false.\r\n1. Set _state_'s value to _disable_.\r\n1. Return true.\r\n\r\nNote: [[DisableDocumentDomain]] does not have an initial value.\r\n\r\ndocument.domain will have these steps:\r\n\r\n1. If DocumentDomainDisabler(this Document object, false) is false, then throw a SecurityError exception.\r\n\r\nNew features will have these steps:\r\n\r\n1. If DocumentDomainDisabler(_someDocument_, true) is false, then ...\r\n\r\nThe Storage Standard would be an example of such a new feature. There may well be others. If this looks good I'm happy to work on a PR for HTML to put this infrastructure in place."},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/193941149","html_url":"https://github.com/whatwg/html/issues/829#issuecomment-193941149","issue_url":"https://api.github.com/repos/whatwg/html/issues/829","id":193941149,"user":{"login":"bholley","id":377435,"avatar_url":"https://avatars.githubusercontent.com/u/377435?v=3","gravatar_id":"","url":"https://api.github.com/users/bholley","html_url":"https://github.com/bholley","followers_url":"https://api.github.com/users/bholley/followers","following_url":"https://api.github.com/users/bholley/following{/other_user}","gists_url":"https://api.github.com/users/bholley/gists{/gist_id}","starred_url":"https://api.github.com/users/bholley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bholley/subscriptions","organizations_url":"https://api.github.com/users/bholley/orgs","repos_url":"https://api.github.com/users/bholley/repos","events_url":"https://api.github.com/users/bholley/events{/privacy}","received_events_url":"https://api.github.com/users/bholley/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T19:53:38Z","updated_at":"2016-03-08T19:53:38Z","body":"It's a low priority for Facebook (and others) because there's not an incentive for them to get rid of it. We could probably cajole Facebook, but I'm less optimistic about others (like, say, Ebay). The only reason people are using document.domain is because they find it more convenient than postMessage. The goal here is to add inconvenience to tilt the balance. I don't think there are any useful partial milestones.\r\n\r\nI think document.domain is probably more like showModalDialog and less like sync XHR - that is to say, it's more likely to be used system that are maintained (if potentially crusty).\r\n\r\nTo be clear, document.domain is less of a security problem in Gecko than it is in other engines, and the biggest victim is probably the spec, which needs to bend over backwards to support it. So while I'm enthusiastic about deprecating it, I'm only interested in pursuing it if we have buy-in across the board."}}