Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

COOP and COEP for local scheme URLs #5403

Closed
yutakahirano opened this issue Mar 26, 2020 · 4 comments
Closed

COOP and COEP for local scheme URLs #5403

yutakahirano opened this issue Mar 26, 2020 · 4 comments
Labels
topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header

Comments

@yutakahirano
Copy link
Member

At https://crbug.com/1063523 and https://crbug.com/1057296, @shhnjk wants to put COOP and COEP of the creator context to blob URLs. This is related to w3c/FileAPI#142 and #4926. There also is a Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1570889
@annevk
Copy link
Member

annevk commented Mar 26, 2020

This is already tracked by #4916 and #5198, right?

@yutakahirano
Copy link
Member Author

Aren't those discussions about inheritance between contexts? @shhnjk's proposal (IIUC) is attaching creator's COOP/COEP to blob URLs, which means when we post such a URL to another context and then initiate a navigation from that context, then the policy of the blob URL (= the policy of the original creator) is used, rather than the policy of that "another context".

@annevk annevk added topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal labels Apr 1, 2020
@annevk
Copy link
Member

annevk commented Apr 1, 2020

#5198 (comment) specifically covers those scenarios. I think that's ideally how blob: URLs behave, but getting there (and ensuring it's implemented) takes some effort.

@yutakahirano
Copy link
Member Author

Thank you very much. Let's close this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic: cross-origin-embedder-policy Issues and ideas around the new "require CORP for subresource requests and frames and etc" proposal topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header
Milestone
No milestone
Development

No branches or pull requests
2 participants
@annevk @yutakahirano