Use of document.domain¶

Scope and migration¶

The document.domain setter is deprecated. Where honored, related origins can use it to relax same-origin restrictions. It cannot grant access to an arbitrary unrelated domain, and modern isolation rules can make it ineffective. Review any reliance on shared subdomain trust; the setter's presence alone is not proof of XSS. See MDN's domain reference.

Parent and embedded preview example¶

Assume frame is the application's specific preview iframe and heading its title element. The fictional parent is https://app.example.test; the child is https://preview.example.test.

Legacy: both documents lower their origin boundary.

// Both parent and child historically set this value.
document.domain = 'example.test';
// Parent, after the child's load:
heading.textContent = frame.contentWindow.document.title;

Safer: the parent accepts only the expected message and sender.

window.addEventListener('message', (event) => {
  if (event.origin !== 'https://preview.example.test' ||
      event.source !== frame.contentWindow) return;
  const data = event.data;
  if (!data || typeof data !== 'object' || Array.isArray(data) ||
      data.type !== 'preview-title' || typeof data.title !== 'string' ||
      data.title.length > 200) return;
  heading.textContent = data.title;
});

After the receiver is registered and the child loads, the child sends:

window.parent.postMessage(
  { type: 'preview-title', title: document.title },
  'https://app.example.test'
);

This exchanges a bounded title without permitting cross-origin DOM access. Both sides use exact origins; the receiver also checks the window identity. Register the receiver before triggering child navigation, or implement a bounded handshake. Never use * for sensitive messages. See the postMessage security guidance.

Regression check¶

Confirm the expected iframe updates the heading as text. Ignore messages from another origin, another window, an incorrect type or an oversized title. Remove the domain setter from both applications and verify supported browsers. See DOM output safety.