Use Location.location.hostname is the modern host string.
Compare optionally. Often matches document.domain when the setter was never used.
Avoid the deprecated API. You can skip document.domain entirely.
Need the port? Use location.host (hostname + port).
Example 3 — Invalid Set Throws SecurityError
Educational only — shows why random domains cannot be assigned.
JavaScript
try {
// Not a parent of the current hostname → should fail
document.domain = "not-a-parent.example";
console.log("unexpected: set succeeded");
} catch (err) {
console.log(err.name); // "SecurityError"
}
console.log("Prefer postMessage — do not use the setter");
SecurityError
Prefer postMessage — do not use the setter
How It Works
Attempt a bad set. Value must be the current host or a parent domain (MDN).
Catch SecurityError. Sandboxes and invalid values throw.
Do not “fix” it. Even valid sets are deprecated and insecure.
Migrate. Use postMessage for intentional cross-origin talk.
Compatibility
Browser Support
Document.domain is Deprecated (MDN). Engines may still expose the getter/setter for legacy pages, but new code should not depend on it.
✓ Deprecated · Avoid setter
Document.domain
Legacy origin domain getter/setter — prefer location.hostname and postMessage.
LegacyAvoid in new apps
Google ChromeSupported · Desktop & Mobile
Full support
Mozilla FirefoxSupported · Desktop & Mobile
Full support
Apple SafariSupported · macOS & iOS
Full support
Microsoft EdgeSupported · Chromium
Full support
Internet ExplorerNo native support · Use a polyfill
Polyfill
OperaSupported · Modern versions
Full support
Samsung InternetSupported · Android
Full support
Android WebViewSupported · Modern WebView
Full support
domainDeprecated
Bottom line: Safe to recognize in old code. For production features: read hosts with location.hostname, and use postMessage for cross-origin communication.
Frequently Asked Questions
It gets or sets the domain portion of the document’s origin used by the same-origin policy. The getter usually returns the hostname; the setter was historically used to relax subdomain boundaries.
Yes. MDN marks Document.domain as Deprecated. Avoid it in new code. Prefer location.hostname to read the host, and Window.postMessage for controlled cross-origin communication.
MDN: the getter is not dangerous in the same way as the setter, but location.hostname is simpler and lets you avoid document.domain entirely.
MDN: it undermines same-origin protections, can expose the DOM across subdomains, drops the port from the origin model, and is especially risky on shared hosting.
Use Window.postMessage to send asynchronous messages between origins. That controlled message-passing is much safer than blanket DOM access via document.domain (MDN).
MDN: a SecurityError DOMException for sandboxed documents, no browsing context, null effective domain, or values that are not the current hostname or a parent domain.