Feature Policy control over document.domain

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 77)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/html/browsers/origin/relaxing-the-same-origin-restriction/document_domain_feature_policy.tentative.sub.html?label=master&product=chrome%5Bexperimental%5D&product=edge&product=firefox%5Bexperimental%5D&product=safari%5Bexperimental%5D&aligned

Summary

The document-domain policy governs access to document.domain. It is enabled by default, and, if disabled, attempting to set document.domain will throw an error.

Standards & signals

Specification: https://github.com/whatwg/html/pull/4170
Firefox: In development
Safari: No signal
Web developers: No signals
Tracking bug: https://crbug.com/904351

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=html%2Fbrowsers%2Forigin%2Frelaxing-the-same-origin-restriction%2Fdocument_domain_feature_policy
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Feature%20Policy%20control%20over%20document.domain
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Feature%20Policy%20control%20over%20document.domain
Baseline status: https://webstatus.dev/?q=Feature%20Policy%20control%20over%20document.domain

Docs: https://github.com/WICG/feature-policy/issues/241

Explainers: https://github.com/w3c/webappsec-feature-policy/issues/241

View on chromestatus.com