Is there a way to configure browsers with a list of "origin aliases" so that a web app functions as expected? If so, how?

For example, I would like to tell the browser https://wiki and https://wiki.example.com are the same origin. That way, when my Media Wiki returns a response with the domain part (https://wiki.example.com), the app won't die due to a same-origin violation because I only used the hostname (https://wiki) to get there.

There's nothing really special about the two origins. If the browser had any intelligence, it would see the network resolver used example.com as a DNS suffix or search domain and they are equivalent at the network level. In fact, the certificate is well formed and has all the names listed in the SAN. So a browser should be able to tell they are equivalent through the name binding that's occurring in the PKIX certificate.

I think this is one of the issues being tackled by the DBOUND Working Group, but it probably won't have a resolution for years.

I currently use three or four browsers: IE, Firefox, Opera and Safari on occasion.

  • Urm, but they most certainly ARE NOT the same origin which is why you have issues. If they are the same, the owner of the web system needs to configure them not you. – Julian Knight Mar 25 '15 at 0:23
  • @Julian - I know why I'm having the issue. It is the same application, and we are the owner of the system. How do you propose we fix the application? Here's the relevant question on Webmasters SE: Configure MediaWiki responses with and without domain part. – jww Mar 25 '15 at 0:31
  • Sorry, its late here and I'm out of time. Maybe this will help? If not, maybe some more info is needed. Sorry I don't have more time. Or here which suggests a solution that may only work with IE (putting the domains into the Trusted Zone). – Julian Knight Mar 25 '15 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.