title: Is it not possible to set document.domain to herokuapp.com? How?
body: <h1>Problem</h1>
  
  <p><code>document.domain = 'herokuapp.com'</code> for a staging app running at <code>#{some_app}.herokuapp.com</code> gives the following console error:</p>
  
  <pre><code>Uncaught SecurityError: Failed to set the 'domain' property on 'Document': 'herokuapp.com' is a top-level domain.
  </code></pre>
  
  <h1>Investigation</h1>
  
  <p>I can trigger this error on any page by trying to set the domain to the page's TLD. For example, pull open console now and try to run <code>document.domain = 'com'</code>.</p>
  
  <p>You would not want a document's domain to be a TLD as this would allow any script from the same TLD to communicate with it. Extrapolating from there it becomes obvious that any Heroku app could communicate with an app who's domain was herokuapp.com as they all run on a subdomain of herokuapp.com. This could be a security problem for anyone who doesn't rigorously disable their staging app at end of day.</p>
  
  <p>From my observations it seems prudent of Heroku to protect their customers by disallowing the setting of herokuapp.com as their page's domain. How are they doing this? I feel it is safe to assume the browser knows to error on all TLDs but somehow <code>herokuapp.com</code> is being registered as a TLD by the browser and triggering the same error. I checked the response headers and haven't found anything so far.</p>
  
  <h1>Work Arounds</h1>
  
  <p>Sorry if you came here looking for a solution. I've only found more information so far but wanted to put this question together to have something Googlable for others. I'm using a few of the potential work arounds below.</p>
  
  <ol>
  <li>Use something else for staging</li>
  <li>Avoid subdomains on Heroku and domain setting on Heroku</li>
  <li>Setup subdomain for staging and point it to Heroku to get around this</li>
  </ol>
  
  <h1>Related</h1>
  
  <p>I also posted this question (<a href="https://stackoverflow.com/questions/35705950/dry-way-for-setting-document-domain-from-rails">DRY way for setting document.domain from Rails</a>) about setting the domain in the first place. I'd love to know if there are better solutions out there for this too.</p>