Location.ancestorOrigins

[smaug----]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: HTML Standard
• Specification or proposal URL:
  https://html.spec.whatwg.org/multipage/history.html#dom-location-ancestororigins
• Caniuse.com URL (optional): https://caniuse.com/mdn-api_location_ancestororigins
• Bugzilla URL (optional): https://bugzilla.mozilla.org/show_bug.cgi?id=1085214
• Mozillians who can provide input (optional): @annevk

Other information

The API has been discussed for a long time. See
https://bugzilla.mozilla.org/show_bug.cgi?id=1085214#c23
https://bugzilla.mozilla.org/show_bug.cgi?id=1085214#c24
https://bugzilla.mozilla.org/show_bug.cgi?id=1085214#c26

[annevk]

See https://bugzilla.mozilla.org/show_bug.cgi?id=1085214#c26 for an analysis, though note that credit should go to bz and tanvi. As currently defined I would say this is harmful and I don't see a clear way to defining a version that is not, as the referrer logic we came up with some years ago only really helps with the first level of nesting (and only partially, due to navigation).

cc @TanviHacks

[eligrey]

@annevk I imagine that this could be explicitly opted in through an expose-ancestor-origins boolean attribute on iframes. Are there any standards discussions about opt-in mechanisms for ancestorOrigins?