v145 · JavaScript · Security

Introducing the Origin API

Chrome 145 exposes a first-class Origin object with isSameOrigin() and isSameSite() methods — replacing error-prone string comparisons with explicit, spec-aligned origin semantics.

concepts

  1. Origin Object Explorer

    Construct Origin objects from URLs and inspect their properties. Compare origins with isSameOrigin() and isSameSite() to understand the distinction between same-origin and same-site.

  2. Cross-Origin Safety Checker

    Enter any two URLs and see whether they are same-origin, same-site, or cross-origin. Reveals how port, scheme, and subdomain changes affect origin and site boundaries — live, with annotated results.

  3. Origin Equivalence Tester

    Preset traps — default port, trailing dot, case folding, scheme mismatch — pre-loaded so you can see how Chrome canonicalises each origin before comparison. Stops same-origin guesswork.

  4. postMessage Origin Guard

    Compare the classic event.origin === expected string guard against the spec-correct isSameOrigin() check. Send messages from different simulated origins — null (opaque), wrong port, evil.example — and see where string comparison silently fails.

why it shipped

The origin is the security boundary of the web: same-origin policy, CORS, storage isolation, and cross-document messaging all hinge on it. Yet before Chrome 145, there was no native way to get an actual Origin object — only string getters (window.location.origin, URL.origin) that return the ASCII serialisation. Comparing those strings is subtly error-prone: a developer might use === on an origin string from an untrusted source without realising that opaque origins serialize to "null", or that blob: and data: URLs produce unexpected strings. isSameOrigin() and isSameSite() encapsulate the spec-correct algorithm, closing a long-standing gap between what the platform guarantees and what developers can easily use.

references