208200 2020-02-25 08:52:58 -0800 A SecurityError is thrown when opening indexedDB in an iframe within a same subdomain tree 2026-01-25 21:45:49 -0800 1 1 1 Unclassified WebKit Website Storage Safari 13 All All NEW http://a.indigital.io InRadar P2 Normal --- 165889 1 benoit.fleuriaud webkit-unassigned annevk bfulgham cdumez marcosc sihui_liu webkit-bug-importer oldest_to_newest 1622623 0 benoit.fleuriaud 2020-02-25 08:52:58 -0800 If you open an IndexedDB connection in an iframe, it throws a SecurityError, that is completely normal if you are in a cross-origin context. But what if you are in a domain, say "a.example.com", and you embed an iframe with "src" equal to "b.a.example.com". The standard (https://html.spec.whatwg.org/multipage/origin.html#relaxing-the-same-origin-restriction) states that you can relax the same-origin restriction that would usually by applied by setting the "document.domain" to the same Second-Level Domain (SLD) in both parent and child contexts. In my example, setting "document.domain" to "example.com" in the top window and the iframe window is legit and should put both in a same-origin context. Here is a reproduction link (http://a.indigital.io) with a minimalist context. The iframe loads http://b.a.indigital.io, which is a subdomain of the opening window. 1836079 1 webkit-bug-importer 2022-02-01 11:19:49 -0800 <rdar://problem/88339063> 1974995 2 annevk 2023-09-01 08:33:41 -0700 That is still cross-origin, though we might change that at some point to use same-site instead. Relaxing the restriction only applies to a select set of features and this is not one of them. Nevertheless, these days you should not get an exception, but rather partitioned storage.