What is `window.origin`? It doesn't seem to be documented in [the usual place](https://developer.mozilla.org/en-US/docs/Web/API/Window/origin).

It looks like it might be very similar to `window.location.origin` - for example, here on Stack Overflow, both return

> 
> 
> ```
> https://stackoverflow.com
> 
> ```
> 
> 

But inside an `iframe`, they're different:

```js
console.log(window.location.origin);
console.log(window.origin);
```

> 
> 
> ```
> https://stacksnippets.net
> null
> 
> ```
> 
> 

The embedded snippet is inside an `iframe` *without* `allow-same-origin`. If you change the iframe, for example, if you edit Stack Overflow's HTML and manually add the attribute:

```
<iframe name="313b857b-943a-7ffd-4663-3d9060cf4cb6" sandbox="allow-same-origin allow-forms allow-modals allow-scripts" class="snippet-box-edit" frameborder="0" style="">
                                                             ^^^^^^^^^^^^^^^^^^

```

and then run the snippet, you get:

> 
> 
> ```
> https://stacksnippets.net
> https://stacksnippets.net
> 
> ```
> 
> 

The same sort of behavior is exhibited on other sites with `<iframe>`s.

[Google](https://www.google.com/search?q=window.origin) does not appear to have any authoritative links on the subject. Searching for the [exact phrase](https://www.google.com/search?q=%22window.origin%22+javascript) + Javascript gives many results related to `iframe`s and `postMessage`, but no precise description of what `window.origin` *actually is*.

Calling `postMessage` from a child `iframe` appears to result in the parent window receiving a message with the `origin` property matching the `window.origin` of the child frame - without `allow-same-origin`, it's `null`, otherwise it looks like it's the same as the `window.location.origin` of the child.

The above is what I *think* I've figured out from guessing-and-checking, but I'm nowhere near certain. I'd appreciate a confirmation/explanation, preferably with a link to an authoritative source.