I am maintaining an application in which I access the origin via window.origin in order to build some URLs.

It works... but I had a security alert because it seems that this variable can be written. For example, go on Google and try that in the dev tools :

> window.origin
<   'https://www.google.com'
> window.origin='yolo'
<   'yolo'
> window.origin
<   'yolo'

This is indeed a security issue as my URLs are built like this : window.origin + "/path/to/other/app" If an attacker could find a way to execute this script window.origin = 'evil.com', customers would be redirected to an unexpected URL.

I found that I could call location.origin instead, which seems safer :

> location.origin
<   'https://www.google.com'
> location.origin='yolo'
<   'yolo'
> location.origin
<   'https://www.google.com'

But does it work on every browser ? Is there a recommended way of getting the origin ?