Checking browser isolation for two IPFS-hosted applications
A gateway hosts two unrelated web apps. Before letting either app store browser state, examine how the final URL assigns an origin to each publisher.
Compare origins without contacting a gateway
Run the JavaScript in a browser console. The labels root-a and root-b stand in for distinct DNS-compatible CIDs; the example only parses URLs. The path-based pair prints true, and the subdomain pair prints false. A pathname is outside the browser’s scheme, host and port comparison.
const pathURL = cid => new URL("https://gateway.example/ipfs/" + cid + "/")
const hostURL = cid => new URL("https://" + cid + ".ipfs.gateway.example/")
console.log(pathURL("root-a").origin === pathURL("root-b").origin)
console.log(hostURL("root-a").origin === hostURL("root-b").origin)
Inspect the URL after redirects
For deployment, use real CIDv1 values encoded for DNS and open each application through the chosen gateway. Inspect location.origin after the page loads. Some gateways redirect a path request to a subdomain, so the initial link alone can mislead the review. Distinct subdomain origins separate origin-scoped storage such as localStorage; cookies explicitly scoped to a shared parent domain require a separate check.