It has to be set in both so their port numbers are both null. Therefore, one cannot make :8080 talk to by only setting document.domain = '' in the first.
Any call to document.domain, including document.domain = document.domain, causes the port number to be overwritten with null. The port number is checked separately by the browser. However, could not set document.domain to, since that is not a superdomain of. Afterward, the page can pass the same-origin check with (assuming sets its document.domain to ' ' to indicate that it wishes to allow that - see document.domain for more).
