It's definitely a fine sanity check but I'd have to really think about whether it's a barrier. Immediate things I worry about are around URL parsing. Is evil.

It's definitely a fine sanity check but I'd have to really think about whether it's a barrier. Immediate things I worry about are around URL parsing. Is evil.com<insert something here>steampowered.com going to pass as "steampowered.com" when it isn't? Will it handle punycode? All sorts of shit can go wrong when parsing a URL, and it's a real world problem when people implement the mitigation you're describing[0]. https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... This is just for starters. I think if I were being paid to think about it I'd probably be able to come up with some more. Can I mess with DNS? Can I inject some other malicious payload into the page, to take advantage of other vulns? etc etc etc I would be extremely wary of this technique as a real boundary rather than just an assertion in code.