Does setting document.domain work in all (most) br

问题:

The Same Origin Policy Documentation says this:

There is one exception to the same origin rule. A script can set the value of document.domain to a suffix of the current domain. If it does so, the shorter domain is used for subsequent origin checks. For example, assume a script in the document at http://store.company.com/dir/other.html executes the following statement:

document.domain = "company.com";

After that statement executes, the page would pass the origin check with http://company.com/dir/page.html. However, by the same reasoning, company.com could not set document.domain to othercompany.com.

Do all popular browsers support this? If not, which ones don't?

回答1:

Firefox 2,3, IE6,7,8, Chrome, and Safari 2 and 3, Opera 9 all support document.domain;

Other "newer" browsers likely will as well, however those are the ones that I've actually tested my code (which makes use of document.domain)

回答2:

Document domain should be lowercase and the rules are like this

// Actual domain is "www.foo.com" 
document.domain = "foo.com"; // this is valid 

// Actual domain is "bar.foo.com" 
document.domain = "www.foo.com"; // this is invalid, "bar.foo.com" is not a subdomain of "www.foo.com" 

// Actual domain is "blah.bar.foo.com" 
document.domain = "bar.foo.com" // Ok 
document.domain = "foo.com" // Still ok 
document.domain = "bar.foo.com" // Invalid, you can't change it back to a more specific domain.