title: window.name as a data transport: a valid approach?
body: <p><strong>Overview and original question</strong></p>
  <p><a href="https://developer.mozilla.org/en/DOM/window.name" rel="nofollow noreferrer">window.name</a> is an interesting beast. MDN's description hints at the original intent:</p>
  <blockquote>
  <p>The name of the window is used primarily for setting targets for hyperlinks and forms. Windows do not need to have names.</p>
  </blockquote>
  <p>So, this means we can open the console in this window, and write:</p>
  <pre><code>var win = window.open('http://google.com', 'el goog');
  </code></pre>
  <p>...and then let it through the popup blocker, that should open google.com in a window named &quot;el goog.&quot; I can't access the <code>name</code> property of <code>win</code> because of the same-origin policy, but if I open a console in the new window and type <code>name</code>, I'll get <code>&quot;el goog&quot;</code>.</p>
  <p>If I send the window back to the domain I opened it from (in this case stackoverflow.com), I can get the <code>name</code> property, and it hasn't changed.</p>
  <pre><code>win.location.replace(location.href);
  win.name; // &quot;el goog&quot;
  </code></pre>
  <p>This means we can have a kind of cross-domain session store by setting the <code>name</code> property of a window.</p>
  <p>If google.com had <em>changed</em> the value of <code>window.name</code> before the window was sent back to the original domain, we'd see the new value instead of &quot;el goog.&quot; This could be used as a cross-domain data transport, similar in utility to JSONP or CORS.</p>
  <p>I did a bit of searching to try to find more info, and apparently dojo <a href="https://www.sitepen.com/blog/windowname-transport" rel="nofollow noreferrer">thinks it's legit</a> as a transport. Somehow, though, that doesn't completely reassure me. So my question is, are any reputable sites using <code>window.name</code> as a data transport? I'd think it would be easily spotted, because their docs would say something like &quot;<em>add 'callback' to the query string for JSONP, or add 'whatever' for window.name,</em>&quot; but I've never seen anything like that. Has anyone actually spotted this in the wild?</p>
  <hr />
  <p><strong>Alternate question</strong></p>
  <p>It may be the case that nobody is really using this technique; if that's true then (as Rob W pointed out) the question above is unanswerable. So, my alternate question is, what are the problems with this approach? This might help explain why it hasn't really been adopted.</p>
  <p>As I see it, there are at least two benefits to this approach over JSONP.</p>
  <ul>
  <li><p>With JSONP, you trust a script from a foreign origin to run on your domain. With <code>window.name</code>, any scripts included by a malicious site would run on their own domain.</p>
  </li>
  <li><p>With JSONP, there is no way to pass in big data (anything too big for a URL), and no way to make an HTTP POST. With <code>window.name</code>, we can post arbitrary data of any size.</p>
  </li>
  </ul>
  <p>What are the drawbacks?</p>
  <hr />
  <p><strong>Example implementation</strong></p>
  <p>Here is a very simple example of a client implementation. This doesn't handle POST requests, only GET.</p>
  <pre><code>function fetchData(url, callback) {
      var frame = document.createElement('iframe');
      frame.onload = function() {
          frame.onload = function() {
              callback(frame.contentWindow.name);
              frame.parentNode.removeChild(frame);
          }
          frame.src = 'about:blank';
      }
      frame.src = url;
      document.body.appendChild(frame);
  }
  
  // using it
  
  fetchData('http://somehost.com/api?foo=bar', function(response) {
  
      console.log(response);
  
  });​
  </code></pre>
  <p>I've set up a fiddle to test it out <a href="http://jsfiddle.net/n9Wnx/" rel="nofollow noreferrer">here</a>.
  It uses <a href="http://jsbin.com/ayehuv/2/edit" rel="nofollow noreferrer">this script</a> as a test server.</p>
  <p>Here is a slightly longer example that can make POST requests: <a href="http://jsfiddle.net/n9Wnx/2/" rel="nofollow noreferrer">http://jsfiddle.net/n9Wnx/2/</a></p>
  <hr />
  <p><strong>Summary</strong></p>
  <p>As far as I can tell, <code>window.name</code> has not caught on as a data transport. I wonder if my perception is accurate (thus the original question) and if so, I wonder <em>why</em> this is the case. I've listed a few advantages that <code>window.name</code> seems to have over JSONP. Can anyone identify some <em>disadvantages</em> that might have contributed to preventing adoption of this technique?</p>
  <p>More to the point, can anyone give me a solid reason why I shouldn't use <code>winow.name</code> as a data transport?</p>