Specify behaviour for sessionStorage with opaque origins

[Zirro]

The specification for the localStorage attribute currently includes a set of "Storage object initialization steps". Among them is a step for throwing a SecurityError if the Document's origin is an opaque origin.

The sessionStorage attribute does not include similar steps at the moment. When I attempt to access window.sessionStorage on about:blank in Chrome and Safari, they throw a SecurityError much like for localStorage. Firefox throws an internal error (NS_ERROR_NOT_AVAILABLE), while I'm not able to test in Edge.

The sessionStorage attribute should presumably also include a set of "Storage object initalization steps" and behave the same way as localStorage for opaque origins.

[domenic]

Oh, interesting! I was in that area of the spec recently and I thought this difference was intentional because sessionStorage is not as persistent. But it sounds like either it was an unintentional mistake, or all browsers missed this difference while implementing.

We should fix the spec; even if it is a reasonable and safe to allow sessionStorage, it's not worth the churn on browsers to add a "feature" that is so esoteric.

[inexorabletash]

FWIW, prompted by https://bugs.chromium.org/p/chromium/issues/detail?id=677733 I did a pass. Safari 12, Firefox 66, Edge 18 and Chrome 73 all throw on access to sessionStorage from an opaque origin. So yeah, let's fix the spec.

Good first PR?

[domenic]

Yeah, not a trivial one since it involves a bit of monkeying with existing text, but not so bad. The goal is to turn the paragraph

The sessionStorage attribute must return a Storage object associated with the Document's assigned session storage area. Each Document object must have a separate object for its relevant global object's sessionStorage attribute.

into a series of three steps: the first two more or less copied from https://html.spec.whatwg.org/multipage/webstorage.html#storage-object-initialisation-steps, and the third containing the existing contents of the paragraph. You can model it after https://html.spec.whatwg.org/multipage/webstorage.html#storage-object-initialisation-steps , but we probably don't need a separate definition for "Storage object initialization steps" or similar.