Re: [whatwg/fetch] Same-origin data-URL flag only for fetch and XHR? (#381)

I enabled data URL support for XHR in Chrome by a bit tricky way (changed WebURLLoaderImpl to virtually issue "Access-Control-Allow-Origin: *" to blink) 2 years ago (http://crbug.com/308768). It's not making data URLs handled as same-origin, but as cross-origin resource but with the CORS header to allow access.

<script> being allowed might be side-effect of the fix.

At the layer of checking same/cross-origin-ness, there could be some special treatment for data scheme, but I'm not so much familiar with.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/381#issuecomment-245210252