Disallow serialization of RTCCertificate except for storage.

[jan-ivar]

Fixes #2257.

@annevk PTAL.

---

Preview | Diff

[jan-ivar]

Are we sure this covers all the same corners as before, even with CORS and iframe.contentDocument poking?

[annevk]

CORS affects networking, not JavaScript access.

If you use document.domain though you'd be able to store an object from a different origin (but same site) in your origin. But you'd also have direct access to that object in that case.

The other potential problem here is that folks might use these objects with postMessage() and that would no longer work. Are all user agents on board with implementing that? Is there test coverage to ensure they do?

[jan-ivar]

Closing given #2257 (comment).

@annevk Is something like a boolean sameOrigin serialization option on anyone's radar?