Quote from Jonas: What this is about is to get rid of essentially all of the AssertApp* functions from [1] and just keep AssertAppPrincipal (which is poorly named) and CheckPermission. Any time a sensitive API in the child process sends a message to the parent process, it should send along the nsIPrincipal of the page that called the API. In the parent process we should then take that nsIPrincipal and call AssertAppPrincipal to make sure that the child process didn't lie about the nsIPrincipal. Then we can call any normal APIs to check if a page with the given nsIPrincipal. For example we can get the app type directly from the nsIPrincipal, or we can call the nsIPermissionManager if the given principal has some specific permission. [1] http://mxr.mozilla.org/mozilla-central/source/dom/ipc/AppProcessChecker.h