diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 4ad16e959634..bfd43e51548d 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -11364,6 +11364,20 @@ nsDocShell::GetIsContent(bool *aIsContent)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDocShell::GetExtendedOrigin(nsIURI *aUri, nsACString &aResult)
+{
+    bool isInBrowserElement;
+    GetIsInBrowserElement(&isInBrowserElement);
+
+    nsCOMPtr<nsIScriptSecurityManager> ssmgr =
+      do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
+    NS_ENSURE_TRUE(ssmgr, false);
+
+    return ssmgr->GetExtendedOrigin(aUri, mAppId, isInBrowserElement, aResult);
+}
+
+
 bool
 nsDocShell::IsOKToLoadURI(nsIURI* aURI)
 {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index be8bbfd299ed..157ce9ab8fb6 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -228,6 +228,7 @@ public:
     NS_IMETHOD GetIsContent(bool*);
     NS_IMETHOD GetUsePrivateBrowsing(bool*);
     NS_IMETHOD SetUsePrivateBrowsing(bool);
+    NS_IMETHOD GetExtendedOrigin(nsIURI *uri, nsACString & retval);
 
     // Restores a cached presentation from history (mLSHE).
     // This method swaps out the content viewer and simulates loads for
diff --git a/docshell/base/nsILoadContext.idl b/docshell/base/nsILoadContext.idl
index 4d0edf2aa038..b899261d285f 100644
--- a/docshell/base/nsILoadContext.idl
+++ b/docshell/base/nsILoadContext.idl
@@ -7,6 +7,7 @@
 #include "nsISupports.idl"
 
 interface nsIDOMWindow;
+interface nsIURI;
 
 /**
  * An nsILoadContext represents the context of a load.  This interface
@@ -78,4 +79,19 @@ interface nsILoadContext : nsISupports
    */
   readonly attribute unsigned long appId;
 
+  /**
+   * Get the extended origin of a channel in this load context.
+   * The extended origin is a string that has more information than the origin
+   * and can be used to isolate data or permissions between different
+   * principals while taking into account parameters like the app id or the
+   * fact that the load is taking place in a mozbrowser.
+   *
+   * In some cases this function will simply return the origin for the
+   * channel's URI.
+   *
+   * The extendedOrigin is intended to be an opaque identifier. It is
+   * currently "human-readable" but no callers should assume it will stay
+   * as-is and it might be crypto-hashed at some point.
+   */
+  AUTF8String GetExtendedOrigin(in nsIURI channel);
 };