[w3c/FileAPI] Top-level navigations to blob URLs with media mime types result in resource load subject to partitioning (Issue #210)

recvfrom created an issue (w3c/FileAPI#210)

In #153 we decided to partition blob URLs except for top-level navigations. One edge case is that if the blob URL has a media mime type, a Document is created and the blob URL is eventually loaded via a "video" element (at least when I tried with a .wav file and a .mp4 file, and IIUC the spec for this behavior is here [1]). If the blob URL was created in a third-party context, the navigation to the blob URL will succeed but the resource load won't because the third-party blob URL is being loaded from a first-party context.

From some testing, Firefox already allows this resource load to complete successfully. I tried testing in Safari but .wav / .mp4 files didn't seem to be supported in general. It seems like allowing the resource load in this case is the right thing to do.

To change this from a spec perspective, we could somehow tag the resource load as being associated with the top-level navigation and thus exempt from partitioning, although we might have to pass that value through a lot of layers and it seems more difficult to implement this (at least in Chromium). Alternatively, we could allow unpartitioned blob URL resource loads by first-party contexts when the resource blob URL being loaded equals the URL of the document itself. It seems intuitive to me that a blob URL document should be able to fetch itself regardless of which context it was created in.

WDYT? +CC @mkruisselbrink @annevk @artines1

[1] https://html.spec.whatwg.org/multipage/document-lifecycle.html#read-media

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/FileAPI/issues/210
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/FileAPI/issues/210@github.com>