1. A computer-implemented method comprising: receiving, at a computing device, a call from a third party object that requests a domain context; ascertaining, by a web application implemented at the computing device, the domain context of the third party object; returning, by the computing device, the domain context to the third party object; requiring, by the computing device, the third party object to include its associated domain context in subsequent calls that the third party object makes; receiving a subsequent call from the third party object; ascertaining, from the subsequent call, the domain context of the third party object; and making a domain context-based decision based on the ascertained domain context by refusing to allow the subsequent call to execute if the third party object's ascertained domain context does not match a target window domain context or allowing the subsequent call to execute if the third party object's ascertained domain context matches the target window domain context.
1. A computer-implemented method comprising: receiving, at a computing device, a call from a third party object that requests a domain context; ascertaining, by a web application implemented at the computing device, the domain context of the third party object; returning, by the computing device, the domain context to the third party object; requiring, by the computing device, the third party object to include its associated domain context in subsequent calls that the third party object makes; receiving a subsequent call from the third party object; ascertaining, from the subsequent call, the domain context of the third party object; and making a domain context-based decision based on the ascertained domain context by refusing to allow the subsequent call to execute if the third party object's ascertained domain context does not match a target window domain context or allowing the subsequent call to execute if the third party object's ascertained domain context matches the target window domain context. 5. The computer-implemented method of claim 1 , further comprising, prior to the receiving the call, receiving HTML content that contains a script that activates or instantiates the third party object.