Re: Blob URL Origin

On May 9, 2014, at 5:29 PM, Arun Ranganathan <arun@mozilla.com> wrote:

> Only Firefox follows the letter of the present day specification correctly.



It’s been pointed out in off-list correspondence that this statement is a bit misleading. ALL current browsers do follow the specification correctly, but because of RFC2119 language not being strict on what MUST be implemented, but only a suggestion about what SHOULD be implemented:

http://dev.w3.org/2006/webapi/FileAPI/#DefinitionOfScheme

Also, no string in JavaScript is truly opaque; this should also be fixed.

Useful input from implementers will be about URL-nesting and security implications, including the pros and cons of URL-encoding components of origin strings.

— A*

Received on Sunday, 11 May 2014 19:31:23 UTC