Intent to Prototype: NoSynchronousThrowForCrossOriginBlockedWorker

[Chromestatus]

Contact emails

bl...@igalia.com

Specification

https://html.spec.whatwg.org/#dom-worker

Summary

To match the spec and the WHATWG issue resolution about the cross-origin violation check for the worker script URL fetching, remove the synchronous SecurityError throw on worker construction and dispatch an error event via the worker's error handler for the cross-origin failure, similar to how DedicatedWorker and SharedWorker already handle Content Security Policy failures.

Blink component

Blink>Workers

Web Feature ID

dedicated-workers

Motivation

In Chrome, Worker/SharedWorker construction currently throws a synchronous SecurityError when the HTTP(S) script URL can't be read by the creator's origin. (e.g. constructing a Worker within an opaque-origin context such as a sandboxed iframe or a data: URL document). But this doesn't match the behavior described in the HTML and Fetch specs. The cross-origin violation on the script URL fetching should be sent as an error event, so the caller can handle the failure asynchronously via the worker's error handler, as per the resolved issue and relevant spec. (https://github.com/whatwg/html/issues/337, https://html.spec.whatwg.org/#dom-worker, https://fetch.spec.whatwg.org/#fetching) Other browsers (Firefox/WebKit) already follow the spec.

Initial public proposal

No information provided

Goals for experimentation

None

Requires code in //chrome?

False

Tracking bug

https://issues.chromium.org/issues/40676421

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5174660823121920?gate=5114273213841408

This intent message was generated by Chrome Platform Status.