Changing the Origin-Agent-Cluster default, aka deprecating document.domain

[otherdaniel]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: n/a
• Specification or proposal URL: This would modify https://html.spec.whatwg.org/multipage/origin.html#origin-isolation.
• Mozillians who can provide input (optional): @annevk has commented on a relevant TAG discussion.

This would be a modification to https://html.spec.whatwg.org/multipage/origin.html#origin-isolation, specifying that an absent (or malformed) header is to be treated like the ?1 case. Plus corresponding editorial changes in create and initialize a Document object. This has the effects of:

1. Turning Origin-Agent-Cluster: from an opt-in into an opt-out mechanism.
2. Modifying usage of document.domain to relax same-origin restrictions becomes an opt-in feature. (You'd have to explicitly set Origin-Agent-Cluster: ?0to keep using it.)
3. WIth origin-keyed agent clustering being allowable by default, browsers should be able to origin-isolate many more pages. (Or at least, have document.domain no longer be in the way.)

Other information

TAG discussion on the subject: w3ctag/design-reviews#564
HTML Spec on Origin-Agent-Cluster: https://html.spec.whatwg.org/multipage/origin.html#origin-isolation
HTML Spec on document.domain: https://html.spec.whatwg.org/#relaxing-the-same-origin-restriction
HTML Spec on initialising a document: https://html.spec.whatwg.org/multipage/browsing-the-web.html#initialise-the-document-object

Chromium plans to issue a deprecation warning for mutating document.domain soon-ish, with the goal of paving the way for this.

[annevk]

Thanks for asking @otherdaniel!

I think this is worth prototyping, similar to Origin-Keyed Agent Clusters itself: https://mozilla.github.io/standards-positions/#domenic-origin-isolation. While there is some potential for website breakage, those websites can address this by setting the HTTP header. Meanwhile, all other websites benefit from the improved security boundary.

I don't think a dashboard entry is needed for this.

I'll keep this open for a bit to see if there are any other comments.

[bholley]

I am strongly in favor of deprecating document.domain.

[annevk]

worth prototyping it is.