Define "same-origin"
annevk opened this issue · 4 comments
Per lore.txt.
Tentative idea is to take the entry script settings object's origin and compare that to the Location object's Realm's origin and also compare it to Location object's relevant Document's origin.
lore.txt is not entirely clear on the matter unfortunately.
Why would we ever use the entry script settings object for this? Why does it matter where script got entered?
In lore.txt the matter is simple, I think: when you invoke the getter of the "location" property on a Window and that Windows is not same-origin with you ("you" being the incumbent settings object) you get back a "cross-origin" Location instance.
Or put another way, any time seeing the prototype of a Location object would expose some object other than a Location instance or WindowProxy across origins, you have to get a "cross-origin" location instance.
At least modulo document.domain. I'm not sure what the intended interactions are there, though @bholley would know.
Yes, we want incumbent here, not entry.
And the current proposal on the table for solving the document.domain identity issue is to eliminate minting.