HTML

The effective domain of an origin origin is computed as follows:

1. If origin is an opaque origin, then return null.

2. If origin's domain is non-null, then return origin's domain.

3. Return origin's host.

The serialization of an origin is the string obtained by applying the following algorithm to the given origin origin:

1. If origin is an opaque origin, then return "null".

2. Otherwise, let result be origin's scheme.

3. Append "://" to result.

4. Append origin's host, serialized, to result.

5. If origin's port is non-null, append a U+003A COLON character (:), and origin's port, serialized, to result.

6. Return result.

Two origins, A and B, are said to be same origin if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins and their schemes, hosts, and port are identical, then return true.

3. Return false.

Two origins, A and B, are said to be same origin-domain if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. If A and B's schemes are identical, and their domains are identical and non-null, then return true.

   2. Otherwise, if A and B are same origin and their domains are both null, return true.

3. Return false.

To obtain a site, given an origin origin, run these steps:

1. If origin is an opaque origin, then return origin.

2. If origin's host's registrable domain is null, then return (origin's scheme, origin's host).

3. Return (origin's scheme, origin's host's registrable domain).

Two sites, A and B, are said to be same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A or B is an opaque origin, then return false.

3. If A's and B's scheme values are different, then return false.

4. If A's and B's host values are not equal, then return false.

5. Return true.

The serialization of a site is the string obtained by applying the following algorithm to the given site site:

1. If site is an opaque origin, then return "null".

2. Let result be site[0].

3. Append "://" to result.

4. Append site[1], serialized, to result.

5. Return result.

Two origins, A and B, are said to be schemelessly same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. Let hostA be A's host, and let hostB be B's host.

   2. If hostA equals hostB and hostA's registrable domain is null, then return true.

   3. If hostA's registrable domain equals hostB's registrable domain and is non-null, then return true.

3. Return false.

Two origins, A and B, are said to be same site if the following algorithm returns true:

1. Let siteA be the result of obtaining a site given A.

2. Let siteB be the result of obtaining a site given B.

3. If siteA is same site with siteB, then return true.

4. Return false.

The domain getter steps are:

1. Let effectiveDomain be this's origin's effective domain.

2. If effectiveDomain is null, then return the empty string.

3. Return effectiveDomain, serialized.

The domain setter steps are:

1. If this's browsing context is null, then throw a "SecurityError" DOMException.

2. If this's active sandboxing flag set has its sandboxed document.domain browsing context flag set, then throw a "SecurityError" DOMException.

3. Let effectiveDomain be this's origin's effective domain.

4. If effectiveDomain is null, then throw a "SecurityError" DOMException.

5. If the given value is not a registrable domain suffix of and is not equal to effectiveDomain, then throw a "SecurityError" DOMException.

6. If the surrounding agent's agent cluster's is origin-keyed is true, then return.

7. Set this's origin's domain to the result of parsing the given value.

To determine if a scalar value string hostSuffixString is a registrable domain suffix of or is equal to a host originalHost:

1. If hostSuffixString is the empty string, then return false.

2. Let hostSuffix be the result of parsing hostSuffixString.

3. If hostSuffix is failure, then return false.

4. If hostSuffix does not equal originalHost:

   1. If hostSuffix or originalHost is not a domain, then return false.

      This excludes hosts that are IP addresses.

   2. If hostSuffix, prefixed by U+002E (.), does not match the end of originalHost, then return false.

   3. If any of the following are true:

      • hostSuffix equals hostSuffix's public suffix; or

      • hostSuffix, prefixed by U+002E (.), matches the end of originalHost's public suffix,

      then return false. [URL]

   4. Assert: originalHost's public suffix, prefixed by U+002E (.), matches the end of hostSuffix.

5. Return true.

Objects implementing the Origin interface's extract an origin steps are to return this's origin.

The new Origin() constructor steps are to set this's origin to a unique opaque origin.

The static from(value) method steps are:

1. If value is a platform object:

   1. Let origin be the result of executing value's extract an origin operation.

   2. If origin is not null, then return a new Origin object whose origin is origin.

2. If value is a string:

   1. Let parsedURL be the result of basic URL parsing value.

   2. If parsedURL is not failure, then return a new Origin object whose origin is set to parsedURL's origin.

3. Throw a TypeError.

The opaque getter steps are to return true if this's origin is an opaque origin; otherwise false.

The isSameOrigin(other) method steps are to return true if this's origin is same origin with other's origin; otherwise false.

The isSameSite(other) method steps are to return true if this's origin is same site with other's origin; otherwise false.

The originAgentCluster getter steps are to return the surrounding agent's agent cluster's is origin-keyed.

To match opener policy values, given an opener policy value documentCOOP, an origin documentOrigin, an opener policy value responseCOOP, and an origin responseOrigin:

1. If documentCOOP is "unsafe-none" and responseCOOP is "unsafe-none", then return true.

2. If documentCOOP is "unsafe-none" or responseCOOP is "unsafe-none", then return false.

3. If documentCOOP is responseCOOP and documentOrigin is same origin with responseOrigin, then return true.

4. Return false.

To obtain an opener policy given a response response and an environment reservedEnvironment:

1. Let policy be a new opener policy.

2. If reservedEnvironment is a non-secure context, then return policy.

3. Let parsedItem be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

4. If parsedItem is not null:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation, then set policy's value to "same-origin-plus-COEP".

      3. Otherwise, set policy's value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's value to "same-origin-allow-popups".

   3. If parsedItem[0] is "noopener-allow-popups", then set policy's value to "noopener-allow-popups".

   4. If parsedItem[1]["report-to"] exists and it is a string, then set policy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value given `Cross-Origin-Opener-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is not null:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation or coep's report-only value is compatible with cross-origin isolation, then set policy's report-only value to "same-origin-plus-COEP".

         Report only COOP also considers report-only COEP to assign the special "same-origin-plus-COEP" value. This allows developers more freedom in the order of deployment of COOP and COEP.

      3. Otherwise, set policy's report-only value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's report-only value to "same-origin-allow-popups".

   3. If parsedItem[1]["report-to"] exists and it is a string, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return policy.

To check if popup COOP values require a browsing context group switch, given two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If responseCOOPValue is "noopener-allow-popups", then return true.

2. If all of the following are true:

   • activeDocumentCOOPValue's value is "same-origin-allow-popups" or "noopener-allow-popups"; and

   • responseCOOPValue is "unsafe-none",

   then return false.

3. If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

4. Return true.

To check if COOP values require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If isInitialAboutBlank is true, then return the result of checking if popup COOP values requires a browsing context group switch with responseOrigin, activeDocumentNavigationOrigin, responseCOOPValue, and activeDocumentCOOPValue.

2. Here we are dealing with a non-popup navigation.

   If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

3. Return true.

To check if enforcing report-only COOP would require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, activeDocumentNavigationOrigin, and two opener policies responseCOOP and activeDocumentCOOP:

1. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOPReportOnly's report-only value is false, then return false.

   Matching report-only policies allows a website to specify the same report-only opener policy on all its pages and not receive violation reports for navigations between these pages.

2. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's value, and activeDocumentCOOPReportOnly's report-only value is true, then return true.

3. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOPReportOnly's value is true, then return true.

4. Return false.

To enforce a response's opener policy, given a browsing context browsingContext, a URL responseURL, an origin responseOrigin, an opener policy responseCOOP, an opener policy enforcement result currentCOOPEnforcementResult, and a referrer referrer:

1. Let newCOOPEnforcementResult be a new opener policy enforcement result with

   needs a browsing context group switch

   currentCOOPEnforcementResult's needs a browsing context group switch

   would need a browsing context group switch due to report-only

   currentCOOPEnforcementResult's would need a browsing context group switch due to report-only

   url

   responseURL

   origin

   responseOrigin

   opener policy

   responseCOOP

   current context is navigation source

   true

2. Let isInitialAboutBlank be browsingContext's active document's is initial about:blank.

3. If isInitialAboutBlank is true and browsingContext's initial URL is null, set browsingContext's initial URL to responseURL.

4. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, currentCOOPEnforcementResult's opener policy's value, currentCOOPEnforcementResult's origin, responseCOOP's value, and responseOrigin is true:

   1. Set newCOOPEnforcementResult's needs a browsing context group switch to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "enforce", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "enforce", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

5. If the result of checking if enforcing report-only COOP would require a browsing context group switch given isInitialAboutBlank, responseOrigin, currentCOOPEnforcementResult's origin, responseCOOP, and currentCOOPEnforcementResult's opener policy, is true:

   1. Set newCOOPEnforcementResult's would need a browsing context group switch due to report-only to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "reporting", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "reporting", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

6. Return newCOOPEnforcementResult.

To obtain a browsing context to use for a navigation response, given navigation params navigationParams:

1. Let browsingContext be navigationParams's navigable's active browsing context.

2. If browsingContext is not a top-level browsing context, then return browsingContext.

3. Let coopEnforcementResult be navigationParams's COOP enforcement result.

4. Let swapGroup be coopEnforcementResult's needs a browsing context group switch.

5. Let sourceOrigin be browsingContext's active document's origin.

6. Let destinationOrigin be navigationParams's origin.

7. If sourceOrigin is not same site with destinationOrigin:

   1. If either of sourceOrigin or destinationOrigin have a scheme that is not an HTTP(S) scheme and the user agent considers it necessary for sourceOrigin and destinationOrigin to be isolated from each other (for implementation-defined reasons), optionally set swapGroup to true.

      For example, if a user navigates from about:settings to https://example.com, the user agent could force a swap.

      Issue #10842 tracks settling on an interoperable behavior here, instead of letting this be optional.

   2. If navigationParams's user involvement is "browser UI", optionally set swapGroup to true.

      Issue #6356 tracks settling on an interoperable behavior here, instead of letting this be optional.

8. If browsingContext's group's browsing context set's size is 1, optionally set swapGroup to true.

   Some implementations swap browsing context groups here for performance reasons.

   The check for other contexts that could script this one is not sufficient to prevent differences in behavior that could affect a web page. Even if there are currently no other contexts, the destination page could open a window, then if the user navigates back, the previous page could expect to be able to script the opened window. Doing a swap here would break that use case.

9. If swapGroup is false:

   1. If coopEnforcementResult's would need a browsing context group switch due to report-only is true, set browsingContext's virtual browsing context group ID to a new unique identifier.

   2. Return browsingContext.

10. Let newBrowsingContext be the first return value of creating a new top-level browsing context and document.

    In this case we are going to perform a browsing context group swap. browsingContext will not be used by the new Document that we are about to create. If it is not used by other Documents either (such as ones in the back/forward cache), then the user agent might destroy it at this point.

11. Let navigationCOOP be navigationParams's cross-origin opener policy.

12. If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContext's group's cross-origin isolation mode to either "logical" or "concrete". The choice of which is implementation-defined.

    It is difficult on some platforms to provide the security properties required by the cross-origin isolated capability. "concrete" grants access to it and "logical" does not.

13. Let sandboxFlags be a clone of navigationParams's final sandboxing flag set.

14. If sandboxFlags is not empty:

    1. Assert: navigationCOOP's value is "unsafe-none".

    2. Assert: newBrowsingContext's popup sandboxing flag set is empty.

    3. Set newBrowsingContext's popup sandboxing flag set to sandboxFlags.

15. Return newBrowsingContext.

To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name P, and an environment settings object environment:

1. If P is not a cross-origin accessible window property name, then return.

2. Assert: accessor's active document and accessed's active document are both fully active.

3. Let accessorTopDocument be accessor's top-level browsing context's active document.

4. Let accessorInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessor's active document's inclusive ancestor navigables.

5. Let accessedTopDocument be accessed's top-level browsing context's active document.

6. Let accessedInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessed's active document's inclusive ancestor navigables.

7. If any of accessorInclusiveAncestorOrigins are not same origin with accessorTopDocument's origin, or if any of accessedInclusiveAncestorOrigins are not same origin with accessedTopDocument's origin, then return.

   This avoids leaking information about cross-origin iframes to a top level frame with opener policy reporting.

8. If accessor's top-level browsing context's virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group ID, then return.

9. Let accessorAccessedRelationship be a new accessor-accessed relationship with value none.

10. If accessed's top-level browsing context's opener browsing context is accessor or is an ancestor of accessor, then set accessorAccessedRelationship to accessor is opener.

11. If accessor's top-level browsing context's opener browsing context is accessed or is an ancestor of accessed, then set accessorAccessedRelationship to accessor is openee.

12. Queue violation reports for accesses, given accessorAccessedRelationship, accessorTopDocument's opener policy, accessedTopDocument's opener policy, accessor's active document's URL, accessed's active document's