KEMBAR78
Should document.domain setter be considered different than 'self' ? · Issue #253 · w3c/webappsec-permissions-policy · GitHub
Skip to content

Should document.domain setter be considered different than 'self' ? #253

@bakulf

Description

@bakulf

Let's say that a page receives Feature-Policy: fullscreen 'self'. If then the page does: document.domain = something, should we allow fullscreen or not? By spec yes, because:

https://wicg.github.io/feature-policy/#parse-policy-directive
9.3.2.9.3.1 "If element is an ASCII case-insensitive match for "'self'", let result be container origin. "

Is this the expected behavior? Should we copy/clone the origin instead? If we copy/clone the origin, 'self' features will not be granted after setting document.domain.

@clelland, would be nice if the spec clarifies this aspect. A note should be sufficient.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions