Is there a way to configure browsers with a list of "origin aliases" so that a web app functions as expected? If so, how?
For example, I would like to tell the browser
https://wiki.example.com are the same origin. That way, when my Media Wiki returns a response with the domain part (
https://wiki.example.com), the app won't die due to a same-origin violation because I only used the hostname (
https://wiki) to get there.
There's nothing really special about the two origins. If the browser had any intelligence, it would see the network resolver used
example.com as a DNS suffix or search domain and they are equivalent at the network level. In fact, the certificate is well formed and has all the names listed in the SAN. So a browser should be able to tell they are equivalent through the name binding that's occurring in the PKIX certificate.
I think this is one of the issues being tackled by the DBOUND Working Group, but it probably won't have a resolution for years.
I currently use three or four browsers: IE, Firefox, Opera and Safari on occasion.