GitHub - mikewest/deprecating-document-domain: `document.domain` intentionally weakens the only security boundary we have. Perhaps we can dump it?

The primary security boundary of the World Wide Web is the origin. The same-origin policy guarantees that one web page cannot access (modify, or extract data from) another page, unless those pages are hosted on the same origin. Several pages within an origin can fully cooperate as a single website, but pages from different origins are isolated and cannot interfere with each other. The same origin

[efcl]

`document.domain`の`Document-Policy: document-domain`でのopt-in化