title: What is window.origin?
body: <p>What is <code>window.origin</code>? It doesn't seem to be documented in <a href="https://developer.mozilla.org/en-US/docs/Web/API/Window/origin" rel="noreferrer">the usual place</a>.</p>
  
  <p>It looks like it might be very similar to <code>window.location.origin</code> - for example, here on Stack Overflow, both return</p>
  
  <blockquote>
  <pre><code>https://stackoverflow.com
  </code></pre>
  </blockquote>
  
  <p>But inside an <code>iframe</code>, they're different:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>console.log(window.location.origin);
  console.log(window.origin);</code></pre>
  </div>
  </div>
  </p>
  
  <blockquote>
  <pre><code>https://stacksnippets.net
  null
  </code></pre>
  </blockquote>
  
  <p>The embedded snippet is inside an <code>iframe</code> <em>without</em> <code>allow-same-origin</code>. If you change the iframe, for example, if you edit Stack Overflow's HTML and manually add the attribute:</p>
  
  <pre><code>&lt;iframe name="313b857b-943a-7ffd-4663-3d9060cf4cb6" sandbox="allow-same-origin allow-forms allow-modals allow-scripts" class="snippet-box-edit" frameborder="0" style=""&gt;
                                                               ^^^^^^^^^^^^^^^^^^
  </code></pre>
  
  <p>and then run the snippet, you get:</p>
  
  <blockquote>
  <pre><code>https://stacksnippets.net
  https://stacksnippets.net
  </code></pre>
  </blockquote>
  
  <p>The same sort of behavior is exhibited on other sites with <code>&lt;iframe&gt;</code>s.</p>
  
  <p><a href="https://www.google.com/search?q=window.origin" rel="noreferrer">Google</a> does not appear to have any authoritative links on the subject. Searching for the <a href="https://www.google.com/search?q=%22window.origin%22+javascript" rel="noreferrer">exact phrase</a> + Javascript gives many results related to <code>iframe</code>s and <code>postMessage</code>, but no precise description of what <code>window.origin</code> <em>actually is</em>.</p>
  
  <p>Calling <code>postMessage</code> from a child <code>iframe</code> appears to result in the parent window receiving a message with the <code>origin</code> property matching the <code>window.origin</code> of the child frame - without <code>allow-same-origin</code>, it's <code>null</code>, otherwise it looks like it's the same as the <code>window.location.origin</code> of the child.</p>
  
  <p>The above is what I <em>think</em> I've figured out from guessing-and-checking, but I'm nowhere near certain. I'd appreciate a confirmation/explanation, preferably with a link to an authoritative source.</p>