Change Origin-Agent-Cluster HTTP header default

[otherdaniel]

This changes the default behaviour for the Origin-Agent-Cluster header
from false to true. That is, an absent header was equivalent to false
(?0) and is now equivalent to true (?1).

WPT test: web-platform-tests/wpt#32819

Implementer interest:

• Chrome: Implemented, and intending to ship: https://groups.google.com/a/chromium.org/g/blink-dev/c/_oRc19PjpFo
• Firefox: Worth prototyping. Changing the Origin-Agent-Cluster default, aka deprecating document.domain mozilla/standards-positions#601
• Safari: No reply. https://lists.webkit.org/pipermail/webkit-dev/2021-December/032067.html
• W3C TAG discussion: Deprecating document.domain setter. w3ctag/design-reviews#564

---

/acknowledgements.html ( diff )
/browsing-the-web.html ( diff )
/origin.html ( diff )
/webappapis.html ( diff )

[annevk]

Looks good! You'll need to make your membership of the googlers GitHub organization public.

I suggest we merge this after it has successfully shipped and stuck for a month or so.

[domenic]

I think we need more updates, mostly to the non-normative introductory text. E.g. https://whatpr.org/html/7617/origin.html#origin-keyed-agent-clusters says

A Document delivered over a secure context can request that it be placed in an origin-keyed agent cluster, by using the Origin-Agent-Cluster HTTP response header.

but it should probably say something like "By default, a Document is in an origin-keyed agent cluster. The Origin-Agent-Cluster header can be used to opt out of this behavior and become site-keyed."

Similarly, with the paragraph starting "The consequences of using this header are that the resulting Document's agent cluster key is its origin..."

[annevk]

That's a good point. We also want to move/adjust this document.domain warning to instead cover this feature:

Avoid using the document.domain setter. It undermines the security protections provided by the same-origin policy. This is especially acute when using shared hosting; for example, if an untrusted third party is able to host an HTTP server at the same IP address but on a different port, then the same-origin protection that normally protects two different sites on the same host will fail, as the ports are ignored when comparing origins after the document.domain setter has been used.

Because of these security pitfalls, this feature is in the process of being removed from the web platform. (This is a long process that takes many years.)

Instead, use postMessage() or MessageChannel objects to communicate across origins in a safe manner.

Minor adjustments in "Integration with the JavaScript agent formalism" might be welcome as well, although I think the existing text could work.