JavaScript Document domain Property

What You’ll Learn

Document.domain is a deprecated instance property that gets or sets the domain portion of the origin for same-origin checks. Learn what the getter returns, why the setter is unsafe, safer alternatives, and five examples with try-it labs.

Introduction

Browsers isolate pages with the same-origin policy. An origin is roughly scheme + host + port (for example https://a.example.com:443). Two pages can normally read each other’s DOM only if they share that origin.

Historically, sites on a.example.com and b.example.com sometimes set document.domain = "example.com" so both pages shared a relaxed domain and could access each other’s DOM. MDN now deprecates that pattern because it is hard to reason about and easy to get dangerously wrong.

Related Document tutorials: documentURI, cookie, Document constructor.

Understanding Document.domain

An instance property on Document that gets/sets the domain portion of the origin (MDN).

• Getter — usually the hostname; empty string for opaque origins (e.g. some data: pages); returns the set value if the setter was used (MDN).
• Setter — may relax same-origin rules to a parent domain; deprecated and dangerous (MDN).
• Limits — only same hostname or a parent domain; otherwise SecurityError.
• Not a no-op — even document.domain = document.domain changes origin accounting (MDN).
• Incomplete — does not unlock all APIs (e.g. some storage / worker checks still use the real origin) (MDN).

📝 Syntax

// Read (legacy — prefer location.hostname)
document.domain

// Write (deprecated — do not use in new code)
document.domain = "example.com";

Value

A string representing the domain portion of the origin (MDN).

Preferred read

const currentHostname = location.hostname;
// Avoid document.domain entirely for new code (MDN)

⚖️ Host / origin APIs compared

🔒 Why the setter is deprecated (MDN)

• Undermines same-origin protections and complicates browser origin models.
• Can grant full DOM access across subdomains—often broader than intended.
• Removes the port component from the origin model; other ports on the same host may gain access.
• Especially insecure on shared hosting (same IP / sibling subdomains).
• May do nothing with modern isolation headers (COOP/COEP, Origin-Agent-Cluster).
• Does not fully unlock APIs such as localStorage, IndexedDB, BroadcastChannel, SharedWorker for subdomain access (MDN).

Examples Gallery

Examples follow MDN Document: domain. Prefer the modern alternatives. Use View Output or Try It Yourself for each case.

const currentDomain = document.domain;
console.log(currentDomain);
// Often the hostname, or "" for opaque origins

developer.mozilla.org

const currentHostname = location.hostname;
console.log(currentHostname);
// Same host string for normal https pages, without using document.domain

developer.mozilla.org

console.log("document.domain:", document.domain);
console.log("location.hostname:", location.hostname);
console.log("location.host:", location.host);
console.log("location.origin:", location.origin);

document.domain: example.com
location.hostname: example.com
location.host: example.com
location.origin: https://example.com

try {
  // On https://example.com this throws (MDN last failure case)
  document.domain = "example.org";
  console.log("Unexpectedly set");
} catch (err) {
  console.log(err.name); // "SecurityError"
}

SecurityError

// Parent page talking to a known iframe origin:
const frame = document.querySelector("iframe");
frame.contentWindow.postMessage(
  { type: "ping", text: "hello" },
  "https://trusted.example.com" // always specify targetOrigin
);

window.addEventListener("message", (event) => {
  if (event.origin !== "https://trusted.example.com") return;
  console.log("Got:", event.data);
});

Messages only accepted from the checked origin
(no shared document.domain required)

🚀 Common Use Cases

• Legacy maintenance — recognize old subdomain “sharing” scripts.
• Migration — replace setters with postMessage or same-origin backends.
• Teaching same-origin — show why relaxing domain is risky.
• Not for new features — MDN: avoid using it; update existing code.
• Host display — use location.hostname, not document.domain.
• Security reviews — flag any document.domain = as a smell.

📝 Notes

• MDN: Deprecated — Deprecated banner shown above; not Experimental / Non-standard.
• Prefer location.hostname for reading the host (MDN).
• Prefer postMessage instead of the setter (MDN).
• Opaque origins may yield an empty string from the getter.
• Related: documentURI, cookie, Document constructor.

💡 Best Practices