Globalutils and self.origin #951

annevk · 2016-03-28T15:31:41Z

See commit messages for details.

domenic · 2016-03-29T21:08:43Z

source

@@ -87428,6 +87428,8 @@ interface <dfn>DocumentAndElementEventHandlers</dfn> {

 [NoInterfaceObject, Exposed=(Window,Worker)]
 interface <dfn>GlobalUtils</dfn> {
+  [Replaceable] readonly attribute USVString <span data-x="dom-origin">origin</span>;


Why Replaceable?

I figured new short properties on the global object need to be replaceable to ease compatibility concerns. If @bzbarsky thinks otherwise I'd be happy to drop it. bz was also who I had in mind as implementer interest from the Gecko side (though not necessarily the person implementing).

domenic · 2016-03-29T21:09:25Z

Can we get some implementer commitments for this new feature?

domenic · 2016-03-29T21:11:17Z

source

-  <p>The <code data-x="dom-windowbase64-atob">atob()</code> and <code
-  data-x="dom-windowbase64-btoa">btoa()</code> methods allow authors to transform content to and from
-  the base64 encoding.</p>
+  <h3 id="globalutils-mixin">The <code>GlobalUtils</code> mixin</h3>


I think WindowWorkerUtils is probably better, given Worklets...

bzbarsky · 2016-03-31T16:04:39Z

Looks ok to me for the "origin" part, as long as we actualy define the origin of every global. I didn't really look at the other pieces.

annevk · 2016-04-01T08:50:25Z

Thanks.

domenic · 2016-04-01T21:16:08Z

Let's move to WindowOrWorkerUtils and then we can merge the first commit. The second commit needs more implementer interest though. @mikewest, @jeisinger, you guys do origin stuff in Blink; any interest in adding self.origin?

annevk · 2016-04-02T05:56:26Z

source


-  <!-- v2: actual binary support -->
+[NoInterfaceObject, Exposed=(Window,Worker)]
+interface <dfn>GlobalUtils</dfn> {


I don't like WindowOrWorkerUtils. I suggest WindowOrWorkerGlobalScope. That's more consistent with DOM mixins. Waiting with fixing this though until we heard back from Googlers, not entirely sure how to merge a single commit.

WindowOrWorkerGlobalScope works for me. I can merge a single commit (or walk you through it) if you want.

jeisinger · 2016-04-02T08:26:13Z

Just to clarify, the attribute should return the origin, not the effective origin?

annevk · 2016-04-02T11:46:02Z

@jeisinger correct (also, note I merged effective script origin into origin with #925 so the specification no longer has that concept).

mikewest · 2016-04-02T19:49:32Z

I don't have any objection to exposing the global object's origin. Would we drop document.origin when we do so? There's probably no harm in having both, but it seems a bit redundant.

jeisinger · 2016-04-03T12:22:35Z

k, should be easy to implement

annevk · 2016-04-03T13:13:12Z

@mikewest see https://bugzilla.mozilla.org/show_bug.cgi?id=931884#c11 where I asked about that. In reply @bzbarsky suggested to have both. (And to try to get folks to not use location.origin for security checks.)

annevk · 2016-04-03T13:19:38Z

Renamed the mixin to WindowOrWorkerGlobalScope.

domenic · 2016-04-05T12:46:49Z

So we'll have three origins, right? location.origin, document.origin, and origin? Will they always return the same value, or not? Should we add examples of how they could differ? Should we add warnings to the two that we don't like?

annevk · 2016-04-05T13:02:54Z

I think document.origin and self.origin will always be identical. location.origin can be different. E.g., <iframe onload=alert(this.contentWindow.location.origin)></iframe> gives "null", which can be very misleading since that window/document will share the origin of its parent.

domenic · 2016-04-05T13:17:05Z

So interestingly, document.origin is only implemented in Blink, and sort of in WebKit. In Safari on my iPad http://jsbin.com/velohejexi/edit?html,console returns "http_null.jsbin.com_0". (In Chrome it returns "http://null.jsbin.com".)

So maybe we should remove document.origin.

domenic · 2016-04-05T13:19:45Z

Regardless I think we should add the example you showed to make it clear how origin and location.origin differ.

annevk · 2016-04-05T14:25:48Z

Yeah, I would be okay with removing document.origin if @bzbarsky, @jeisinger, et al, are on board with that. That's a simple change to the DOM Standard.

I will add an example contrasting self.origin and location.origin later and ping this thread.

bzbarsky · 2016-04-05T14:34:46Z

Will they always return the same value, or not?

We actually have four things: document.origin, bareword origin, self.origin, and location.origin. I believe document.origin (written exactly like that) and bareword origin will always return the same thing. self.origin will NOT necessarily return the same thing in cases when the code is running in a navigated-away-from window, because then self is a WindowProxy to the new Window; it will either return the same thing, throw, or return a different thing, depending on whether the navigation was cross-origin or not and depending on what happened with document.domain.

I guess the behavior of bareword origin isn't quite defined by specs either (but of course neither is self.origin), and may well not even be interoperable across browsers in the navigated-away-from case....

annevk · 2016-04-05T16:07:02Z

Bareword origin being a side effect of adding self.origin, I take it? That difference we should maybe call out under Window/WindowProxy.

bzbarsky · 2016-04-05T16:11:19Z

Bareword origin being a side effect of adding self.origin, I take it?

If you want to view it that way, yes.

domenic · 2016-04-05T19:43:38Z

source

-  <p>The <code data-x="dom-windowbase64-atob">atob()</code> and <code
-  data-x="dom-windowbase64-btoa">btoa()</code> methods allow authors to transform content to and from
-  the base64 encoding.</p>
+  <h3 id="windoworworkerglobalscope-mixin">The <code>WindowOrWorkerGlobalScope</code> mixin</h3>


This probably should get an intro paragraph explaining what it is and that other specs can extend it. Just a section with an IDL block kind of sucks.

Done, also added an example.

This makes the following editorial changes: * Groups base64, timer, and ImageBitmap properties on a single mixin. * Removes overloading of timer methods in favor of a union type It is expected that other standards will make use of this mixin, e.g., Fetch will use it to define fetch().

Fixes https://www.w3.org/Bugs/Public/show_bug.cgi?id=28801.

domenic · 2016-04-06T20:04:05Z

OK cool, this looks good to me; merging. Still unsure about whether [Replaceable] is a great idea, but I guess it's safer that way.

domenic reviewed Mar 29, 2016
View reviewed changes

domenic added the addition/proposal New features or enhancements label Mar 29, 2016

domenic reviewed Mar 29, 2016
View reviewed changes

domenic added the needs implementer interest Moving the issue forward requires implementers to express interest label Mar 29, 2016

annevk assigned bzbarsky Mar 31, 2016

annevk assigned domenic and unassigned bzbarsky Apr 1, 2016

annevk reviewed Apr 2, 2016
View reviewed changes

annevk force-pushed the globalutils branch from 0c07a0e to 8e93632 Compare April 3, 2016 13:19

domenic reviewed Apr 5, 2016
View reviewed changes

annevk force-pushed the globalutils branch from 8e93632 to ff65e69 Compare April 6, 2016 07:57

domenic mentioned this pull request Apr 6, 2016

Wire up 'HostEnsureCanCompileStrings' to CSP #1005

Closed

annevk added 2 commits April 6, 2016 16:00

Introducing self.origin, a reliable way to get the origin of a global

6bdba31

Fixes https://www.w3.org/Bugs/Public/show_bug.cgi?id=28801.

domenic force-pushed the globalutils branch from ff65e69 to 6bdba31 Compare April 6, 2016 20:04

domenic merged commit 6bdba31 into master Apr 6, 2016

domenic deleted the globalutils branch April 6, 2016 20:04

This was referenced May 10, 2016

document.suborigin or something should allow JS to detect if in suborigin w3c/webappsec-suborigins#35

Open

Add example for different origins #1222

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Globalutils and self.origin #951

Globalutils and self.origin #951

annevk commented Mar 28, 2016

domenic Mar 29, 2016

annevk Mar 30, 2016

domenic commented Mar 29, 2016

domenic Mar 29, 2016

bzbarsky commented Mar 31, 2016

annevk commented Apr 1, 2016

domenic commented Apr 1, 2016

annevk Apr 2, 2016

domenic Apr 2, 2016

jeisinger commented Apr 2, 2016

annevk commented Apr 2, 2016

mikewest commented Apr 2, 2016

jeisinger commented Apr 3, 2016

annevk commented Apr 3, 2016

annevk commented Apr 3, 2016

domenic commented Apr 5, 2016

annevk commented Apr 5, 2016

domenic commented Apr 5, 2016

domenic commented Apr 5, 2016

annevk commented Apr 5, 2016

bzbarsky commented Apr 5, 2016

annevk commented Apr 5, 2016

bzbarsky commented Apr 5, 2016

domenic Apr 5, 2016

annevk Apr 6, 2016

domenic commented Apr 6, 2016

Globalutils and self.origin #951

Globalutils and self.origin #951

Conversation

annevk commented Mar 28, 2016

domenic Mar 29, 2016

Choose a reason for hiding this comment

annevk Mar 30, 2016

Choose a reason for hiding this comment

domenic commented Mar 29, 2016

domenic Mar 29, 2016

Choose a reason for hiding this comment

bzbarsky commented Mar 31, 2016

annevk commented Apr 1, 2016

domenic commented Apr 1, 2016

annevk Apr 2, 2016

Choose a reason for hiding this comment

domenic Apr 2, 2016

Choose a reason for hiding this comment

jeisinger commented Apr 2, 2016

annevk commented Apr 2, 2016

mikewest commented Apr 2, 2016

jeisinger commented Apr 3, 2016

annevk commented Apr 3, 2016

annevk commented Apr 3, 2016

domenic commented Apr 5, 2016

annevk commented Apr 5, 2016

domenic commented Apr 5, 2016

domenic commented Apr 5, 2016

annevk commented Apr 5, 2016

bzbarsky commented Apr 5, 2016

annevk commented Apr 5, 2016

bzbarsky commented Apr 5, 2016

domenic Apr 5, 2016

Choose a reason for hiding this comment

annevk Apr 6, 2016

Choose a reason for hiding this comment

domenic commented Apr 6, 2016