[whatwg/url] Tighten 'same site' checks to include 'scheme'. (#449)

This patch introduces 'schemelessly same site' on both 'host' and 'URL',
moves 'same site' to URL, and tightens it by requiring a scheme match in
addition to a registrable domain match. This, hopefully, will create
stronger security boundaries in places where we perform "same site"
checks, while giving us the flexibility to grandparent in existing
behavior we decide to keep.

Partially addresses whatwg/url#448.
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/url/pull/449

-- Commit Summary --

  * Tighten 'same site' checks to include 'scheme'.

-- File Changes --

    M url.bs (115)

-- Patch Links --

https://github.com/whatwg/url/pull/449.patch
https://github.com/whatwg/url/pull/449.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/pull/449