Intent to Prototype: BlobOpaqueOriginForInnerNonHttpNonFileScheme

[Chromestatus]

Contact emails

bl...@igalia.com

Explainer

https://github.com/Igalia/explainers/tree/main/blob-url-opaque-origin

Specification

https://url.spec.whatwg.org/#origin

Summary

Give a blob URL an opaque origin unless the scheme of its inner URL is http, https, or file. When a blob URL is created from an inner URL with any other scheme, such as ftp, ws, or wss, its origin becomes opaque and serializes as 'null' instead of being copied from the inner URL, so the blob URL is treated as cross-origin to everything else. This gives web developers consistent and predictable origin behavior for blob URLs across browsers.

Blink component

Blink>Network

Web Feature ID

origin

Motivation

The URL Standard defines a blob URL's origin as the origin of its inner URL only when the inner scheme is http, https, or file, and an opaque origin otherwise. Chrome instead derives an origin from the inner URL for any standard scheme, including ones such as ftp, ws, and wss that are not allowed to preserve their origin for the blob URL, while Firefox and Safari work as specified.

Initial public proposal

No information provided

Goals for experimentation

None

Requires code in //chrome?

False

Tracking bug

https://crbug.com/534847486

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5079000453087232?gate=5165818469023744

This intent message was generated by Chrome Platform Status.