2 ms·
@cperciva – wrong. Both pages have to opt into the same domain for that to work. As in, even if the "evil script" set it's domain to yourdomain.com, unless you
by bentlegen 14y ago
@cperciva – wrong. Both pages have to opt into the same domain for that to work.
As in, even if the "evil script" set it's domain to yourdomain.com, unless your pages on yourdomain.com ALSO do
document.domain = 'yourdomain.com';
The script on the subdomain can't access that content.
[EDIT] Whoever is downvoting this, can you demonstrate otherwise?
- cperciva 14y agoMy understanding is that pages from yourdomain.com would already have document.domain set to 'yourdomain.com', but I'm not a javascript expert.
- bentlegen 14y ago@cperciva – it is and it isn't. Implicit vs explicit. This answer expands: http://stackoverflow.com/a/3978372 http://stackoverflow.com/a/3978372
- cperciva 14y agoThis reminds me of the WAT talk. It's also crazy enough that I wouldn't want to trust that every browser in the world will always share that same behaviour.
- bentlegen 14y agoThis document.domain behaviour is documented as part of the HTML spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/origin-0.html#relaxing-the-same-origin-restriction http://www.whatwg.org/specs/web-apps/current-work/multipage/...