From 9d56f343dcfe7f39d5715f5acf4afda17635907f Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 29 Oct 2025 09:34:37 +0000 Subject: [PATCH 1/7] [Origin API] Define an `Origin` interface. (#11534) This patch shifts the normative portions of https://mikewest.github.io/origin-api/ into a patch against HTML for discussion. As a followup, this will require changes to [[URL]] and [[ServiceWorker]] as well to define the "extract an origin" for relevant objects. See discussion in https://github.com/w3ctag/design-reviews/issues/1130, https://github.com/WebKit/standards-positions/issues/538, and https://github.com/mozilla/standards-positions/issues/1280. --- source | 157 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 157 insertions(+) diff --git a/source b/source index ca1389014e0..0e54e88cab1 100644 --- a/source +++ b/source @@ -26062,6 +26062,18 @@ document.body.appendChild(wbr);

An element implementing the HTMLHyperlinkElementUtils mixin has an associated url (null or a URL). It is initially null. +

+

An element implementing the HTMLHyperlinkElementUtils mixin has the following + extract an origin steps:

+ +
    +

  1. If this's url is null, return + null.

    2. +

  2. Return this's url's + origin.

    3. +
+
+

An element implementing the HTMLHyperlinkElementUtils mixin has an associated set the url algorithm, which runs these steps:

@@ -92415,6 +92427,104 @@ dictionary DragEventInit : MouseEventInit {
+
The Origin interface
+ +

The Origin interface represents an + origin, allowing robust same origin and same site + comparisons.

+ + 
[Exposed=*]
+interface Origin {
+  constructor();
+
+  static Origin from(any value);
+
+  readonly attribute boolean opaque;
+
+  boolean isSameOrigin(Origin other);
+  boolean isSameSite(Origin other);
+};
+ +

Origin objects have an + [[origin]] internal slot, which holds an + origin.

+ +

Platform objects have an + extract an origin operation, which returns null unless + otherwise specified.

+ +
+

Objects implementing the Origin interface's + extract an origin steps are to return this's + [[origin]].

+
+ +
+

The new Origin() constructor steps are:

+ +
    +

  1. Set this's [[origin]] internal slot to a unique + opaque origin.

    2. +
+
+ +
+

The static from(value) + method accepts an arbitrary object value, and returns either a newly-constructed + Origin object if one can be extracted from + value, or throws a TypeError otherwise:

+ +
    +
  1. +

    If value is a platform object:

    +
      +

    1. Let origin be the result of executing value's extract an + origin operation.

      2. +

    2. If origin is not null, return a new + Origin object whose [[origin]] is set + to origin.

      3. +
    +
    2. +
  2. +

    If value is a string:

    +
      +

    1. Let parsed url be the result of basic URL + parsing value.

      2. +

    2. If parsed url is not failure, return a new + Origin object whose [[origin]] is set + to parsed url's origin.

      3. +
    +
    3. +

  3. Throw a TypeError.

    4. +
+
+ +
+

The opaque attribute + getter steps are to return true if this's [[origin]] is an opaque origin, and false otherwise.

+
+ +
+

The isSameOrigin(other) method returns true if + this's [[origin]] is same origin with other's + [[origin]], and false otherwise.

+
+ +
+

The isSameSite(other) method returns true if + this's [[origin]] is same site with other's + [[origin]], and false otherwise.

+ +

This is a same site, not schemelessly same + site, comparison. For the reasons explained in URL The + Origin origin does not offer schemeless comparison.

+
+

Origin-keyed agent clusters

@@ -96906,6 +97016,21 @@ interface Location { // but see also origin is not same origin-domain with + the entry settings object's + origin, then return null.

+ +

  • Return this's url's + origin.

    • + + +

    A Location object has an associated ancestor origins list. When a @@ -123029,6 +123154,24 @@ document.body.appendChild(frame) capability.

    +
    +

    An element implementing the WindowOrWorkerGlobalScope mixin has the following + extract an origin steps:

    + +
      +

    1. If this's relevant settings object's origin is not same origin-domain + with the entry settings object's origin, return null.

      2. + +

    2. Return this's return this's relevant settings + object's origin.

      3. +
    + +

    Since these objects are potentially accessible cross-origin (e.g. through + WindowProxy), we need a security check here before granting access to the origin.

    +
    + @@ -127539,6 +127682,12 @@ typedef (WindowProxy or MessagePort or ServiceWo fragment).

    +
    +

    Objects implementing the MessageEvent interface's extract an origin + steps are to return this's relevant settings object's + origin.

    +
    +

    The lastEventId attribute must return the value it @@ -131655,6 +131804,14 @@ interface WorkerLocation {

    +
    +

    Objects implementing the WorkerLocation interface's extract an origin + steps are to return this's WorkerGlobalScope object's + url's origin.

    +
    +

    A WorkerLocation object has an associated WorkerGlobalScope object (a WorkerGlobalScope object). From b0fdce52977c41bf9defe1dbe44a905413651da0 Mon Sep 17 00:00:00 2001 From: Mike West Date: Fri, 7 Nov 2025 10:50:46 +0000 Subject: [PATCH 2/7] fixup @annevk's feedback --- source | 54 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/source b/source index 0e54e88cab1..b1054448bfa 100644 --- a/source +++ b/source @@ -26067,8 +26067,9 @@ document.body.appendChild(wbr); extract an origin steps:

      -

    1. If this's url is null, return - null.

      2. +

    2. If this's url is null, then + return null.

      3. +

    3. Return this's url's origin.

    @@ -92445,8 +92446,8 @@ interface Origin { boolean isSameSite(Origin other); }; -

    Origin objects have an - [[origin]] internal slot, which holds an +

    Origin objects have an associated + origin, which holds an origin.

    Platform objects have an @@ -92456,7 +92457,7 @@ interface Origin {

    Objects implementing the Origin interface's extract an origin steps are to return this's - [[origin]].

    + origin.

    @@ -92464,7 +92465,7 @@ interface Origin { data-x="dom-Origin-constructor">new Origin() constructor steps are:

      -

    1. Set this's [[origin]] internal slot to a unique +

    2. Set this's origin to a unique opaque origin.

    @@ -92481,48 +92482,49 @@ interface Origin {

    1. Let origin be the result of executing value's extract an origin operation.

      2. -

    2. If origin is not null, return a new - Origin object whose [[origin]] is set - to origin.

      3. + +

    3. If origin is not null, then return a new + Origin object whose + origin is set to origin.

    +

  • If value is a string:

    1. Let parsed url be the result of basic URL parsing value.

      2. -

    2. If parsed url is not failure, return a new - Origin object whose [[origin]] is set - to parsed url's origin.

      3. + +

    3. If parsed url is not failure, then return a new + Origin object whose + origin is set to parsed url's + origin.

    -
    • + +

  • Throw a TypeError.

    • The opaque attribute - getter steps are to return true if this's [[origin]] is an opaque origin, and false otherwise.

    + getter steps are to return true if this's + origin is an opaque + origin, and false otherwise.

    The isSameOrigin(other) method returns true if - this's [[origin]] is same origin with other's - [[origin]], and false otherwise.

    + this's origin is same origin + with other's origin, and false otherwise.

    The isSameSite(other) method returns true if - this's [[origin]] is same site with other's - [[origin]], and false otherwise.

    - -

    This is a same site, not schemelessly same - site, comparison. For the reasons explained in URL The - Origin origin does not offer schemeless comparison.

    + this's origin is same site with + other's origin, and false otherwise.

    @@ -123162,13 +123164,13 @@ document.body.appendChild(frame)

  • If this's relevant settings object's origin is not same origin-domain with the entry settings object's origin, return null.

    • + data-x="concept-settings-object-origin">origin, then return null.

  • Return this's return this's relevant settings object's origin.

    • -

    Since these objects are potentially accessible cross-origin (e.g. through +

    Since these objects are potentially accessible cross-origin (e.g., through WindowProxy), we need a security check here before granting access to the origin.

    From 2904ac23c5c4e081ac8ddc4fc3a65604b342f461 Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 19 Nov 2025 07:54:50 +0000 Subject: [PATCH 3/7] fixup closes origin-api/issues#11 --- source | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/source b/source index b1054448bfa..f50b2ff9227 100644 --- a/source +++ b/source @@ -92525,6 +92525,12 @@ interface Origin { data-x="dom-Origin-isSameSite">isSameSite(other) method returns true if this's origin is same site with other's origin, and false otherwise.

    + +

    Note that same-site checks might return different values for the same origins in + different user agents, or even in the same user agent at different times, as the public suffix + list is updated and distributed in implementation-defined ways. isSameSite() reflects the user agent's current understanding + of the relationship between two origins, but makes no promises about the future.

    From 37fa9233e00ba7b6010363a28b36cabb69b53b64 Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 19 Nov 2025 14:53:57 +0000 Subject: [PATCH 4/7] fixup more feedback --- source | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-) diff --git a/source b/source index f50b2ff9227..5b0bab2e3e5 100644 --- a/source +++ b/source @@ -92447,7 +92447,7 @@ interface Origin { };

    Origin objects have an associated - origin, which holds an + origin, which holds an origin.

    Platform objects have an @@ -92457,7 +92457,7 @@ interface Origin {

    Objects implementing the Origin interface's extract an origin steps are to return this's - origin.

    + origin.

    @@ -92465,16 +92465,14 @@ interface Origin { data-x="dom-Origin-constructor">new Origin() constructor steps are:

      -

    1. Set this's origin to a unique +

    2. Set this's origin to a unique opaque origin.

    -

    The static from(value) - method accepts an arbitrary object value, and returns either a newly-constructed - Origin object if one can be extracted from - value, or throws a TypeError otherwise:

    +

    The static from(value) method steps are:

    1. @@ -92485,7 +92483,7 @@ interface Origin {

    2. If origin is not null, then return a new Origin object whose - origin is set to origin.

      3. + origin is set to origin.

    @@ -92497,7 +92495,7 @@ interface Origin {

  • If parsed url is not failure, then return a new Origin object whose - origin is set to parsed url's + origin is set to parsed url's origin.

    • @@ -92509,28 +92507,22 @@ interface Origin {

    The opaque attribute getter steps are to return true if this's - origin is an opaque - origin, and false otherwise.

    + origin is an opaque + origin; otherwise false.

    The isSameOrigin(other) method returns true if - this's origin is same origin - with other's origin, and false otherwise.

    + this's origin is same origin + with other's origin; otherwise false.

    The isSameSite(other) method returns true if - this's origin is same site with - other's origin, and false otherwise.

    - -

    Note that same-site checks might return different values for the same origins in - different user agents, or even in the same user agent at different times, as the public suffix - list is updated and distributed in implementation-defined ways. isSameSite() reflects the user agent's current understanding - of the relationship between two origins, but makes no promises about the future.

    + this's origin is same site with + other's origin; otherwise false.

    From 2d77ad20597c2ae83de38559c31eecf4653bb83c Mon Sep 17 00:00:00 2001 From: Mike West Date: Fri, 21 Nov 2025 15:37:55 +0000 Subject: [PATCH 5/7] fixup drop location and workerlocation --- source | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/source b/source index 5b0bab2e3e5..808dcf6db88 100644 --- a/source +++ b/source @@ -97016,21 +97016,6 @@ interface Location { // but see also origin is not same origin-domain with - the entry settings object's - origin, then return null.

    - -

  • Return this's url's - origin.

    • - -
    -

    A Location object has an associated ancestor origins list. When a @@ -131804,13 +131789,6 @@ interface WorkerLocation {

    -
    -

    Objects implementing the WorkerLocation interface's extract an origin - steps are to return this's WorkerGlobalScope object's - url's origin.

    -

    A WorkerLocation object has an associated WorkerGlobalScope object (a From a85adea4659a3d84939a84261c9248cbee94e052 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 3 Dec 2025 13:32:23 +0100 Subject: [PATCH 6/7] many nits --- source | 67 +++++++++++++++++++++++++++------------------------------- 1 file changed, 31 insertions(+), 36 deletions(-) diff --git a/source b/source index 808dcf6db88..3b5c9df0dd1 100644 --- a/source +++ b/source @@ -92438,36 +92438,31 @@ dictionary DragEventInit : MouseEventInit { interface Origin { constructor(); - static Origin from(any value); + static Origin from(any value); readonly attribute boolean opaque; - boolean isSameOrigin(Origin other); - boolean isSameSite(Origin other); + boolean isSameOrigin(Origin other); + boolean isSameSite(Origin other); }; -

    Origin objects have an associated - origin, which holds an - origin.

    +

    Origin objects have an associated origin, which holds an origin.

    -

    Platform objects have an - extract an origin operation, which returns null unless - otherwise specified.

    +

    Platform objects have an extract an origin operation, which returns null unless otherwise specified.

    Objects implementing the Origin interface's - extract an origin steps are to return this's - origin.

    + extract an origin steps are to return this's origin.

    The new Origin() constructor steps are:

    - -
      -

    1. Set this's origin to a unique - opaque origin.

      2. -
    + data-x="dom-Origin-constructor">new Origin() constructor steps are to set + this's origin to a unique opaque origin.

    @@ -92481,22 +92476,22 @@ interface Origin {

  • Let origin be the result of executing value's extract an origin operation.

    • -

  • If origin is not null, then return a new - Origin object whose - origin is set to origin.

    • +

  • If origin is not null, then return a new Origin object whose origin is origin.

  • If value is a string:

      -

    1. Let parsed url be the result of basic URL +

    2. Let parsedURL be the result of basic URL parsing value.

      3. -

    3. If parsed url is not failure, then return a new - Origin object whose - origin is set to parsed url's - origin.

      4. +

    4. If parsedURL is not failure, then return a new Origin object whose origin is set to parsedURL's origin.

    • @@ -92505,24 +92500,25 @@ interface Origin {
    -

    The opaque attribute - getter steps are to return true if this's - origin is an opaque - origin; otherwise false.

    +

    The opaque getter + steps are to return true if this's origin + is an opaque origin; otherwise false.

    The isSameOrigin(other) method returns true if - this's origin is same origin - with other's origin; otherwise false.

    + data-x="dom-Origin-isSameOrigin">isSameOrigin(other) method steps are to + return true if this's origin is + same origin with other's origin; otherwise false.

    The isSameSite(other) method returns true if - this's origin is same site with - other's origin; otherwise false.

    + data-x="dom-Origin-isSameSite">isSameSite(other) method steps are to + return true if this's origin is + same site with other's origin; + otherwise false.

    @@ -131789,7 +131785,6 @@ interface WorkerLocation {
    -

    A WorkerLocation object has an associated WorkerGlobalScope object (a WorkerGlobalScope object). From 01111757376ae0e209814dcb181d3cc111c7da55 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 3 Dec 2025 13:34:12 +0100 Subject: [PATCH 7/7] Update source --- source | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source b/source index 3b5c9df0dd1..6137eb246f2 100644 --- a/source +++ b/source @@ -92438,12 +92438,12 @@ dictionary DragEventInit : MouseEventInit { interface Origin { constructor(); - static Origin from(any value); + static Origin from(any value); readonly attribute boolean opaque; - boolean isSameOrigin(Origin other); - boolean isSameSite(Origin other); + boolean isSameOrigin(Origin other); + boolean isSameSite(Origin other); };

    Origin objects have an associated