Intent to Implement and Ship: Allow data: and blob: schemes in Fetch API

[Hiroshige Hayashizaki]

Contact emails

hiro...@chromium.org

Spec

https://fetch.spec.whatwg.org/

Summary

Allow data: and blob: schemes in Fetch API, i.e.

fetch('data:...') and fetch('blob:...').

Motivation

Access to these schemes are already provided by XHR but not by Fetch API.

Allowing these schemes in Fetch API will make it easier for developers to move to Fetch API.

Compatibility Risk

Low. Access to data: and blob: URLs is:

• Already enabled in XHR in Chrome.
• Already enabled in Fetch API in Firefox 40.
  

I expect my implementation will be slightly non-conformant to the spec:

• Redirects to data URLs in no-cors mode will be rejected in Chrome (should be allowed in the spec), because Chromium-side intentionally refuses redirects to data URLs (for example see https://crbug.com/64092).
• Redirects to blob URLs will be rejected in Chrome (should be allowed in the spec). Currently such requests are rejected also in the exsiting XHR implementation (https://crbug.com/532782).

Ongoing technical constraints

None.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes.

OWP launch tracking bug

None.

Normal tracking bugs:

data: https://crbug.com/521475

blob: https://crbug.com/521466

Link to entry on the feature dashboard

Fetch API

https://www.chromestatus.com/feature/6730533392351232

Requesting approval to ship?

Yes.

[Anne van Kesteren]

On Thu, Sep 17, 2015 at 9:08 AM, Hiroshige Hayashizaki
<hiro...@chromium.org> wrote:
> Redirects to data URLs in no-cors mode will be rejected in Chrome (should be
> allowed in the spec), because Chromium-side intentionally refuses redirects
> to data URLs (for example see https://crbug.com/64092).

FWIW, per the issue you filed I plan to align the standard with Chromium here.

> Redirects to blob URLs will be rejected in Chrome (should be allowed in the
> spec). Currently such requests are rejected also in the exsiting XHR
> implementation (https://crbug.com/532782).

Perhaps we should block this in the standard as well. Redirecting to
blob URLs is somewhat out there. Do you know what other browsers do?


--
https://annevankesteren.nl/

[Hiroshige Hayashizaki]

>> Redirects to data URLs in no-cors mode will be rejected in Chrome (should be

>> allowed in the spec), because Chromium-side intentionally refuses redirects
>> to data URLs (for example see https://crbug.com/64092).
> FWIW, per the issue you filed I plan to align the standard with Chromium here.

+net-dev.

Yes, I filed: https://github.com/whatwg/fetch/issues/111.

• There are some other issues in Blink related to "redirects to data URLs", tracked by https://crbug.com/527326.
  I was planning to align Fetch API with these issues, but I haven't received strong requirements/responses from Blink/Chromium folks.
  
• Rejecting redirects to data URLs is Chromium's policy, and I'm not sure whether we should upstream it to the spec.

Does anyone have opinion on these or issues related to redirects to data URLs? I welcome inputs.

(I'll do some investigation and respond later for the latter)

[Hiroshige Hayashizaki]

>> Redirects to blob URLs will be rejected in Chrome (should be allowed in the

>> spec). Currently such requests are rejected also in the exsiting XHR

>> implementation (https://crbug.com/532782).

> Perhaps we should block this in the standard as well. Redirecting to

> blob URLs is somewhat out there. Do you know what other browsers do?

Firefox: allowed (both in XHR and Fetch API).

This is Blink-specific bug and I think no need to block the spec.

[Chris Harrelson]

LGTM1

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Philip Jägenstedt]

LGTM2

[Dimitri Glazkov]

LGTM3

[Hiroshige Hayashizaki]

Created chromestatus page: https://www.chromestatus.com/feature/5744736207896576

(context: https://code.google.com/p/chromium/issues/detail?id=521466#c10)