documentDomains

Reports uses of document.domain which relaxes same-origin protections.

✅ This rule is included in the browser logical presets.

The document.domain API changes the origin the browser uses for same-origin checks. Setting it can let pages on related subdomains access each other when the browser would otherwise keep them isolated. Use location.hostname or location.origin when you only need to read the current page’s host or origin.

Examples

❌ Incorrect

document.domain = "example.com";

window.document.domain = "example.com";

✅ Correct

const currentHost = location.hostname;

const currentOrigin = location.origin;

Options

This rule is not configurable.

When Not To Use It

If you maintain a legacy app that temporarily depends on cross-subdomain same-origin relaxation while migration is in progress, it may be reasonable to disable this rule for those files. For new code, prefer current host checks or server-side origin configuration instead.

Further Reading

• MDN: document.domain
• MDN: location.hostname
• MDN: Same-origin policy

Equivalents in Other Linters

• ESLint: sdl/no-document-domain