Re: Question about origin serialization

Adam Barth wrote:
> What are the all the different string forms?  The two I'm aware of are:
> 
> 1) postMessage's origin property
> 2) XHR's Origin header

You're assuming no one else will make use of these serialization rules?

> Browser implementations won't be able to replace same-origin checks
> with comparing these strings because of document.domain

document.domain just comes down to modifying which origins you compare, 
for what it's worth.

-Boris