CODEWITHSUNDEEP
javascript
Polar
Polar

Reputation: 345

Don't allow changing document.domain value

I need to deny changing document.domain. Say, if I run this code at foo.boo.com

Object.defineProperty(document, 'domain', { 
    get: function () {
        return 'foo.boo.com';
    }
});

and then will it be possible to set document.domain to boo.com? I ask because I want to deny changing document.domain by untrusted code.

Upvotes: 2

Views: 487

Answers (1)

ceejayoz
ceejayoz

Reputation: 180065

The code you propose does not appear to work at all. Safari:

A demonstration of it failing to prevent modification of document.domain in Chrome:

enter image description here

Upvotes: 1

Related Questions