Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions files/en-us/_redirects.txt
Original file line number Diff line number Diff line change
Expand Up @@ -13430,7 +13430,7 @@
/en-US/docs/Web/HTTP/Headers/Feature-Policy/autoplay /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/autoplay
/en-US/docs/Web/HTTP/Headers/Feature-Policy/camera /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/camera
/en-US/docs/Web/HTTP/Headers/Feature-Policy/display-capture /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/display-capture
/en-US/docs/Web/HTTP/Headers/Feature-Policy/document-domain /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/document-domain
/en-US/docs/Web/HTTP/Headers/Feature-Policy/document-domain /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
/en-US/docs/Web/HTTP/Headers/Feature-Policy/encrypted-media /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/encrypted-media
/en-US/docs/Web/HTTP/Headers/Feature-Policy/fullscreen /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/fullscreen
/en-US/docs/Web/HTTP/Headers/Feature-Policy/gamepad /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/gamepad
Expand Down Expand Up @@ -13487,7 +13487,7 @@
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/compute-pressure /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/compute-pressure
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/cross-origin-isolated /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/cross-origin-isolated
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/display-capture /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/display-capture
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/document-domain /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/document-domain
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/document-domain /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/encrypted-media /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/encrypted-media
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/fullscreen /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/fullscreen
/en-US/docs/Web/HTTP/Headers/Permissions-Policy/gamepad /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/gamepad
Expand Down Expand Up @@ -13630,6 +13630,7 @@
/en-US/docs/Web/HTTP/Public_Key_Pinning /en-US/docs/Web/Security/Certificate_Transparency
/en-US/docs/Web/HTTP/Range_requests /en-US/docs/Web/HTTP/Guides/Range_requests
/en-US/docs/Web/HTTP/Redirections /en-US/docs/Web/HTTP/Guides/Redirections
/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/document-domain /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
/en-US/docs/Web/HTTP/Resources_and_URIs /en-US/docs/Web/HTTP/Guides/MIME_types
/en-US/docs/Web/HTTP/Resources_and_specifications /en-US/docs/Web/HTTP/Reference/Resources_and_specifications
/en-US/docs/Web/HTTP/Response_codes /en-US/docs/Web/HTTP/Reference/Status
Expand Down
4 changes: 0 additions & 4 deletions files/en-us/_wikihistory.json
Original file line number Diff line number Diff line change
Expand Up @@ -98922,10 +98922,6 @@
"modified": "2020-10-15T22:18:20.836Z",
"contributors": ["sideshowbarker", "bershanskiy", "Sheppy"]
},
"Web/HTTP/Reference/Headers/Permissions-Policy/document-domain": {
"modified": "2020-10-15T22:11:41.981Z",
"contributors": ["bershanskiy", "chrisdavidmills", "sideshowbarker"]
},
"Web/HTTP/Reference/Headers/Permissions-Policy/encrypted-media": {
"modified": "2020-10-15T22:10:28.002Z",
"contributors": ["mfuji09", "bershanskiy", "fscholz"]
Expand Down
4 changes: 1 addition & 3 deletions files/en-us/web/api/document/domain/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ A string.
### Exceptions

- `SecurityError` {{domxref("DOMException")}}
- : Use of this feature was blocked by a [Permissions Policy](/en-US/docs/Web/HTTP/Guides/Permissions_Policy).
- : The document is forbidden from setting its domain, for example it is sandboxed or has an opaque origin. See [Failures section](#failures) for details.

## Examples

Expand Down Expand Up @@ -118,8 +118,6 @@ blanket exposure of all data caused by `document.domain`.
The setter will throw a `SecurityError` {{domxref("DOMException")}} in
several cases:

- The {{httpheader('Permissions-Policy/document-domain','document-domain')}}
{{HTTPHeader("Permissions-Policy")}} is disabled.
- The document is inside a sandboxed {{htmlelement("iframe")}}.
- The document has no {{glossary("browsing context")}}.
- The document's [effective domain](https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain) is `null`.
Expand Down

This file was deleted.

2 changes: 1 addition & 1 deletion files/en-us/web/security/same-origin_policy/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ Afterward, the page can pass the same-origin check with `http://company.com/dir/

The port number is checked separately by the browser. Any call to `document.domain`, including `document.domain = document.domain`, causes the port number to be overwritten with `null`. Therefore, one **cannot** make `company.com:8080` talk to `company.com` by only setting `document.domain = "company.com"` in the first. It has to be set in both so their port numbers are both `null`.

The mechanism has some limitations. For example, it will throw a `SecurityError` [`DOMException`](/en-US/docs/Web/API/DOMException) if the [`document-domain`](/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/document-domain) [`Permissions-Policy`](/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy) is enabled or the document is in a sandboxed [`<iframe>`](/en-US/docs/Web/HTML/Reference/Elements/iframe), and changing the origin in this way does not affect the origin checks used by many Web APIs (e.g., [`localStorage`](/en-US/docs/Web/API/Window/localStorage), [`indexedDB`](/en-US/docs/Web/API/IndexedDB_API), [`BroadcastChannel`](/en-US/docs/Web/API/BroadcastChannel), [`SharedWorker`](/en-US/docs/Web/API/SharedWorker)). A more exhaustive list of failure cases can be found in [Document.domain > Failures](/en-US/docs/Web/API/Document/domain#failures).
The mechanism has some limitations. For example, it will throw a `SecurityError` [`DOMException`](/en-US/docs/Web/API/DOMException) if the document is in a sandboxed [`<iframe>`](/en-US/docs/Web/HTML/Reference/Elements/iframe), and changing the origin in this way does not affect the origin checks used by many Web APIs (e.g., [`localStorage`](/en-US/docs/Web/API/Window/localStorage), [`indexedDB`](/en-US/docs/Web/API/IndexedDB_API), [`BroadcastChannel`](/en-US/docs/Web/API/BroadcastChannel), [`SharedWorker`](/en-US/docs/Web/API/SharedWorker)). A more exhaustive list of failure cases can be found in [Document.domain > Failures](/en-US/docs/Web/API/Document/domain#failures).

> [!NOTE]
> When using `document.domain` to allow a subdomain to access its parent, you need to set `document.domain` to the _same value_ in both the parent domain and the subdomain. This is necessary even if doing so is setting the parent domain back to its original value. Failure to do this may result in permission errors.
Expand Down