Dialog focusing steps same origin check

[annevk]

Should this be same origin or same origin-domain?

cc @rakina

[zcorpan]

The autofocus attribute uses same origin. But it also checks all ancestor browsing contexts, whereas dialog doesn't:

https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute:same-origin

https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:same-origin

I suppose there's a reason autofocus does this. Does it not apply to dialog, or is it an oversight?

[domenic]

Autofocus has used same-origin since before #4763 when it was rewritten, i.e. that rewrite just preserved it.

The check on the entire ancestor chain was introduced in #6204. There was some discussion at the time as to whether it was necessary, and I guess I pushed for it. The motivation was to avoid a cross-origin information leak, in nesting cases like A1 -> B -> A2. See #6204 (comment) .

I think that same motivation applies to dialog, and so it was an oversight that dialog was not updated.

As for same origin vs. same origin-domain, I think there would be no problem with loosening it to same origin-domain, since same origin-domain pages leak information and collaborate already. It's more just a question as to whether we want to be consistent (and thus use same origin-domain) or start moving away from that world as part of document.domain deprecation. Probably at this point we shouldn't change anything...