Origins are the fundamental currency of the Web's security model. Two actors in the Web platform that share an origin are assumed to trust each other and to have the same authority. Actors with differing origins are considered potentially hostile versus each other, and are isolated from each other to varying degrees.
For example, if Example Bank's Web site, hosted at
bank.example.com, tries to examine the DOM of Example Charity's Web site, hosted
SecurityError exception will be
The origin of a resource and the effective script origin of a resource are both either opaque identifiers or tuples consisting of a scheme component, a host component, a port component, and optionally extra data.
The extra data could include the certificate of the site when using encrypted connections, to ensure that if the site's secure certificate changes, the origin is considered to change as well.
7.3.1 Relaxing the same-origin restriction
domain[ = domain ]
Returns the current domain used for security checks.
Can be set to a value that removes subdomains, to change the effective script origin to allow pages on other subdomains of the same domain (if they do the same thing) to access each other. (Can't be set in sandboxed
domain attribute is used to enable
pages on different hosts of a domain to access each others' DOMs.
Do not use the
attribute when using shared hosting. If an untrusted third party is able to host an HTTP server at
the same IP address but on a different port, then the same-origin protection that normally
protects two different sites on the same host will fail, as the ports are ignored when comparing
origins after the
document.domain attribute has been
A sandboxing flag set is a set of zero or more of the following flags, which are used to restrict the abilities that potentially untrusted resources have:
- The sandboxed navigation browsing context flag
This flag prevents content from navigating browsing contexts other than the sandboxed browsing context itself (or browsing contexts further nested inside it), auxiliary browsing contexts (which are protected by the sandboxed auxiliary navigation browsing context flag defined next), and the top-level browsing context (which is protected by the sandboxed top-level navigation browsing context flag defined below).
If the sandboxed auxiliary navigation browsing context flag is not set, then in certain cases the restrictions nonetheless allow popups (new top-level browsing contexts) to be opened. These browsing contexts always have one permitted sandboxed navigator, set when the browsing context is created, which allows the browsing context that created them to actually navigate them. (Otherwise, the sandboxed navigation browsing context flag would prevent them from being navigated even if they were opened.)
- The sandboxed auxiliary navigation browsing context flag
This flag prevents content from creating new auxiliary browsing contexts, e.g. using the
window.open()method, or the
- The sandboxed top-level navigation browsing context flag
When the sandboxed top-level navigation browsing context flag is not set, content can navigate its top-level browsing context, but other browsing contexts are still protected by the sandboxed navigation browsing context flag and possibly the sandboxed auxiliary navigation browsing context flag.
- The sandboxed plugins browsing context flag
This flag prevents content from instantiating plugins, whether using the
appletelement, or through navigation of a nested browsing context, unless those plugins can be secured.
- The sandboxed seamless iframes flag
This prevents a page inserted using the
allow-same-originkeyword from using a CSS-selector-based method of probing the DOM of other pages on the same site (in particular, pages that contain user-sensitive information).
- The sandboxed origin browsing context flag
This flag also prevents script from reading from or writing to the
document.cookieIDL attribute, and blocks access to
- The sandboxed forms browsing context flag
This flag blocks form submission.
- The sandboxed pointer lock browsing context flag
This flag disables the Pointer Lock API. [POINTERLOCK]
- The sandboxed scripts browsing context flag
This flag blocks script execution.
- The sandboxed automatic features browsing context flag
- The sandboxed fullscreen browsing context flag
This flag prevents content from using the
- The sandboxed
document.domainbrowsing context flag
When the user agent is to parse a sandboxing directive, given a string input, a sandboxing flag set output, and optionally an allow fullscreen flag, it must run the following steps:
Split input on spaces, to obtain tokens.
Let output be empty.
Add the following flags to output:
The sandboxed auxiliary navigation browsing context flag, unless tokens contains the
The sandboxed top-level navigation browsing context flag, unless tokens contains the
The sandboxed origin browsing context flag, unless the tokens contains the
allow-same-originkeyword is intended for two cases.
First, it can be used to allow content from the same site to be sandboxed to disable scripting, while still allowing access to the DOM of the sandboxed content.
Second, it can be used to embed content from a third-party site, sandboxed to prevent that site from opening pop-up windows, etc, without preventing the embedded page from communicating back to its originating site, using the database APIs to store data, etc.
The sandboxed forms browsing context flag, unless tokens contains the
The sandboxed pointer lock browsing context flag, unless tokens contains the
The sandboxed scripts browsing context flag, unless tokens contains the
The sandboxed automatic features browsing context flag, unless tokens contains the
allow-scriptskeyword (defined above).
This flag is relaxed by the same keyword as scripts, because when scripts are enabled these features are trivially possible anyway, and it would be unfortunate to force authors to use script to do them when sandboxed rather than allowing them to use the declarative features.
Every top-level browsing context has a popup sandboxing flag set, which is a sandboxing flag set. When a browsing context is created, its popup sandboxing flag set must be empty. It is populated by the rules for choosing a browsing context given a browsing context name.
Every nested browsing context has an
iframe sandboxing flag
set, which is a sandboxing flag set. Which flags in a nested browsing
iframe sandboxing flag set are set at any particular
time is determined by the
Document has an active sandboxing flag set, which is a
sandboxing flag set. When the
Document is created, its active
sandboxing flag set must be empty. It is populated by the navigation
Every resource that is obtained by the navigation algorithm has a forced sandboxing flag set, which is a sandboxing flag set. A resource by default has no flags set in its forced sandboxing flag set, but other specifications can define that certain flags are set.
When a user agent is to implement the sandboxing for a
Document's active sandboxing flag set with the union of
the flags that are present in the following sandboxing flag
sets at the time the
Document object is created: