Re: [whatwg/fetch] Partition Blob URL fetches by Storage Key (PR #1783)

I'm a little worried about this approach as it means obtaining and revoking are maintained in independent specifications, but need to be kept synchronized to maintain the privacy and security boundary.

I think a more ideal setup would be that File API keeps the `Blob` objects out of reach (i.e., they're no longer directly accessible from a 'blob URL entry') and instead exposes some kind of "obtain" algorithm that we hand the 'blob URL entry' and current 'environment' (or maybe a storage key). That way File API can stay in charge of obtaining and revoking and most of the logic associated with that. And Fetch can mainly concern itself with translating a Blob into a response.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1783#issuecomment-2493209801
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1783/c2493209801@github.com>