[Origin API] Define an `Origin` interface. (#11534) #11846

mikewest · 2025-10-29T09:48:39Z

This patch adds the Origin interface to HTML by shifting the normative
portions of https://mikewest.github.io/origin-api/ into this document.

As a followup, this will require changes to [[URL]] and [[ServiceWorker]] as well to define the "extract an origin" for relevant objects.

See discussion in w3ctag/design-reviews#1130, WebKit/standards-positions#538, and mozilla/standards-positions#1280.

At least two implementers are interested (and none opposed):
- I'm interested on Chromium's behalf.
- An Origin Object WebKit/standards-positions#538 is tending positive, though @annevk and @marcoscaceres have provided positive feedback.
- An Origin Object mozilla/standards-positions#1280 is similarly inconclusive.
Tests are written and can be reviewed and commented upon at:
- https://wpt.fyi/results/html/browsers/origin/tentative/api?label=master&label=experimental&aligned&q=origin%2Ftentative%2F has an initial pass at tests. If this is something folks agree to add to the platform, I'll make them non-tentative.
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/434131026
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=2001139
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=302785
MDN issue is filed: Document the Origin API. mdn/mdn#767
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/browsers.html ( diff )
/comms.html ( diff )
/index.html ( diff )
/links.html ( diff )
/webappapis.html ( diff )
/workers.html ( diff )

zcorpan · 2025-11-05T15:16:07Z

I would like to see mikewest/origin-api#6 addressed.

annevk

Some editorial comments. Generally this looks good to me.

source

whatwg/html#11846 (comment) noted that we should verify schemeful same-site comparison; this CL adds that test. Bug: 434131026 Change-Id: I48878979fc0f8c3dab2caefbe788a14d367e053b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7130621 Reviewed-by: Antonio Sartori <[email protected]> Commit-Queue: Mike West <[email protected]> Cr-Commit-Position: refs/heads/main@{#1541759}

… schemeful., a=testonly Automatic update from web-platform-tests [Origin API] Verify that comparisons are schemeful. whatwg/html#11846 (comment) noted that we should verify schemeful same-site comparison; this CL adds that test. Bug: 434131026 Change-Id: I48878979fc0f8c3dab2caefbe788a14d367e053b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7130621 Reviewed-by: Antonio Sartori <[email protected]> Commit-Queue: Mike West <[email protected]> Cr-Commit-Position: refs/heads/main@{#1541759} -- wpt-commits: 08b913918dd419fe48d01ef685781a69ced0a111 wpt-pr: 55938

… schemeful., a=testonly Automatic update from web-platform-tests [Origin API] Verify that comparisons are schemeful. whatwg/html#11846 (comment) noted that we should verify schemeful same-site comparison; this CL adds that test. Bug: 434131026 Change-Id: I48878979fc0f8c3dab2caefbe788a14d367e053b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7130621 Reviewed-by: Antonio Sartori <antoniosartorichromium.org> Commit-Queue: Mike West <mkwstchromium.org> Cr-Commit-Position: refs/heads/main{#1541759} -- wpt-commits: 08b913918dd419fe48d01ef685781a69ced0a111 wpt-pr: 55938 UltraBlame original commit: 313ef5bf80f71a4e57fc5bebfd0d784dd667b024

This patch shifts the normative portions of https://mikewest.github.io/origin-api/ into a patch against HTML for discussion. As a followup, this will require changes to [[URL]] and [[ServiceWorker]] as well to define the "extract an origin" for relevant objects. See discussion in w3ctag/design-reviews#1130, WebKit/standards-positions#538, and mozilla/standards-positions#1280.

mikewest · 2025-11-19T07:59:37Z

source

+  <p class="note">Note that same-site checks might return different values for the same origins in
+  different user agents, or even in the same user agent at different times, as the public suffix
+  list is updated and distributed in implementation-defined ways. <span
+  data-x="dom-Origin-isSameSite">isSameSite()</span> reflects the user agent's current understanding
+  of the relationship between two origins, but makes no promises about the future.</p>


I added this note in response to @erik-anderson's suggestion in mikewest/origin-api#11. Otherwise, I think this PR is pretty good to go.

If @annevk and @zcorpan are happy-enough, I'll go file bugs against browsers, and see if Chromium folks will let me get it out the door.

WDYT?

I'm not a big fan of this as there's quite a number of APIs this applies to and I don't think we want to call this out all over. I could maybe see adding it to URL (or even better would be the Public Suffix standard once we finally rescue that project from its current state).

Ok. I've taken it back out, and I'll put it up as a PR against URL.

source

annevk · 2025-11-19T09:40:05Z

source

+  <p>The <dfn method for="Origin"><code
+  data-x="dom-Origin-isSameOrigin">isSameOrigin(other)</code></dfn> method returns true if
+  <span>this</span>'s <span data-x="dom-Origin-origin">origin</span> is <span>same origin</span>
+  with <var>other</var>'s <span data-x="dom-Origin-origin">origin</span>, and false otherwise.</p>


Suggested change

with <var>other</var>'s origin, and false otherwise.

with <var>other</var>'s origin; otherwise false.

source

annevk · 2025-11-19T09:41:23Z

source

+  <p class="note">Note that same-site checks might return different values for the same origins in
+  different user agents, or even in the same user agent at different times, as the public suffix
+  list is updated and distributed in implementation-defined ways. <span
+  data-x="dom-Origin-isSameSite">isSameSite()</span> reflects the user agent's current understanding
+  of the relationship between two origins, but makes no promises about the future.</p>


I'm not a big fan of this as there's quite a number of APIs this applies to and I don't think we want to call this out all over. I could maybe see adding it to URL (or even better would be the Public Suffix standard once we finally rescue that project from its current state).

mikewest

Thanks!

mikewest · 2025-11-19T14:55:01Z

source

+  <p class="note">Note that same-site checks might return different values for the same origins in
+  different user agents, or even in the same user agent at different times, as the public suffix
+  list is updated and distributed in implementation-defined ways. <span
+  data-x="dom-Origin-isSameSite">isSameSite()</span> reflects the user agent's current understanding
+  of the relationship between two origins, but makes no promises about the future.</p>


Ok. I've taken it back out, and I'll put it up as a PR against URL.

annevk

I was looking at this again today thinking about Document vs Window and now I wonder about Location and WorkerLocation.

I followed blame back to https://bugzilla.mozilla.org/show_bug.cgi?id=931884#c10 (starting at 6bdba31) which suggests to me that obtaining an Origin from Location or WorkerLocation is not something we should offer by default. You can still do it by passing location.href, if you really know what you're doing, but in general those objects don't really hold the authority and so we shouldn't encourage that.

For a moment I thought they'd work anyway because of the string overload, but because we take any it's different I think and we won't attempt to coerce any argument to a string. Which in this case seems for the best.

mikewest · 2025-11-21T13:43:11Z

I followed blame back to https://bugzilla.mozilla.org/show_bug.cgi?id=931884#c10 (starting at 6bdba31) which suggests to me that obtaining an Origin from Location or WorkerLocation is not something we should offer by default. You can still do it by passing location.href, if you really know what you're doing, but in general those objects don't really hold the authority and so we shouldn't encourage that.

I understand your point, but it seems unlikely we're going to be able to get rid of location.origin given its usage, it would be slightly odd for this to be the only interface with an origin property that Origin.from() wouldn't support. I think I'd suggest erring on the side of consistency, but I don't hold that opinion too strongly.

annevk · 2025-11-21T14:51:56Z

Right, I don't mean to suggest we get rid of that. Each URL-like object should support that, but I do think it's worth trying to hold the line here and get people to adopt the pattern that'll do the right thing in sandboxed environments and the like. We can always relent later. I'm also not entirely sure about <a> and <area>. The use cases for strings, globals, and message events seem clear though.

mikewest · 2025-11-21T15:17:17Z

Ah, got it. Sandboxed contexts in which the origin differs between Location and Window seem like a sufficiently sharp edge that I think I'm convinced that dropping Location to start with is pretty reasonable. If we decide to add it later, it's trivial.

I don't know of any particularly valuable use cases for HTMLHyperlinkElementUtils, but it seems non-harmful in the same way strings and URLs are. 🤷 I'd just drop Location.

annevk · 2025-11-21T15:28:07Z

That works for me. I wonder how much longer we want to wait with feedback. Perhaps the Wednesday after Thanksgiving week (Dec 3) is a reasonable time to merge this if nothing else comes up (modulo the Location change)?

mikewest · 2025-11-21T15:42:04Z

I took care of dropping Location and WorkerLocation in 2d77ad2, and I'll up a CL against Chromium to do the same. I'm fine with giving folks a little more time to weigh in. No rush.

annevk · 2025-11-21T15:42:26Z

One other thing we need by that date is a WPT PR to make the tests non-tentative and account for the recent changes.

mikewest force-pushed the origin-api branch from fd7d152 to ca52252 Compare November 5, 2025 08:51

mikewest added the topic: origin label Nov 5, 2025

This was referenced Nov 5, 2025

An Origin Object WebKit/standards-positions#538

Open

An Origin Object mozilla/standards-positions#1280

Open

mikewest mentioned this pull request Nov 5, 2025

Verbosity / ease of use mikewest/origin-api#6

Open

annevk reviewed Nov 6, 2025

View reviewed changes

source Outdated Show resolved Hide resolved

source Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

chromium-wpt-export-bot mentioned this pull request Nov 7, 2025

[Origin API] Verify that comparisons are schemeful. web-platform-tests/wpt#55938

Merged

mikewest added 3 commits November 19, 2025 07:39

fixup @annevk's feedback

b0fdce5

fixup closes origin-api/issues#11

2904ac2

mikewest force-pushed the origin-api branch from b86a48a to 2904ac2 Compare November 19, 2025 07:55

mikewest commented Nov 19, 2025

View reviewed changes

annevk reviewed Nov 19, 2025

View reviewed changes

mikewest mentioned this pull request Nov 19, 2025

Origin API web-platform-dx/web-features#3554

Open

fixup more feedback

37fa923

mikewest commented Nov 19, 2025

View reviewed changes

mikewest mentioned this pull request Nov 19, 2025

Document the Origin API. mdn/mdn#767

Open

annevk reviewed Nov 21, 2025

View reviewed changes

fixup drop location and workerlocation

2d77ad2

	with <var>other</var>'s <span data-x="dom-Origin-origin">origin</span>, and false otherwise.</p>
	with <var>other</var>'s <span data-x="dom-Origin-origin">origin</span>; otherwise false.</p>

[Origin API] Define an Origin interface. (#11534) #11846

Are you sure you want to change the base?

[Origin API] Define an Origin interface. (#11534) #11846

Conversation

mikewest commented Oct 29, 2025 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zcorpan commented Nov 5, 2025

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikewest Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

annevk Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

mikewest Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

annevk Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

mikewest left a comment

Choose a reason for hiding this comment

Uh oh!

mikewest Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

mikewest commented Nov 21, 2025

Uh oh!

annevk commented Nov 21, 2025

Uh oh!

mikewest commented Nov 21, 2025

Uh oh!

annevk commented Nov 21, 2025

Uh oh!

mikewest commented Nov 21, 2025

Uh oh!

annevk commented Nov 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

[Origin API] Define an `Origin` interface. (#11534) #11846

[Origin API] Define an `Origin` interface. (#11534) #11846

mikewest commented Oct 29, 2025 •

edited by pr-preview bot

Loading