106488 2013-01-09 13:50:18 -0800 Should `window.location.origin` return 'null' in a sandbox? 2013-02-08 04:53:46 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED INVALID P2 Normal --- 0 mkwst mkwst abarth syoichi oldest_to_newest 803659 0 mkwst 2013-01-09 13:50:18 -0800 '<iframe sandbox="allow-scripts" src="frame.html"></iframe>' with a framed document containing '<script>alert(window.location.origin);</script>' alerts the actual origin of the document, which wasn't what I expected. I'm not sure what's intended, but I expected that treating the framed document as existing in a unique origin would have some effect on the string output as it's location's origin. WDYT, Adam? 803692 1 abarth 2013-01-09 14:10:45 -0800 It just returns the origin of the document's location, not the origin of the document itself. I agree that's surprising for sandboxed documents. 803699 2 mkwst 2013-01-09 14:20:29 -0800 (In reply to comment #1) > It just returns the origin of the document's location, not the origin of the document itself. I agree that's surprising for sandboxed documents. Is it surprising enough that we should clearly change it, or should I just drop a note to the WHATWG? 803762 3 abarth 2013-01-09 15:05:33 -0800 I'd ask annevk on whatwg@, but I agree that we should probably change it. :) 828445 4 mkwst 2013-02-08 04:53:46 -0800 Asked on whatwg@, Anne was unsurprised. FF's implementation matches ours, let's just leave it.