-
Notifications
You must be signed in to change notification settings - Fork 47
Description
In #153 we decided to partition blob URLs except for top-level navigations. One edge case is that if the blob URL has a media mime type, a Document is created and the blob URL is eventually loaded via a "video" element (at least when I tried with a .wav file and a .mp4 file, and IIUC the spec for this behavior is here [1]). If the blob URL was created in a third-party context, the navigation to the blob URL will succeed but the resource load won't because the third-party blob URL is being loaded from a first-party context.
From some testing, Firefox already allows this resource load to complete successfully. I tried testing in Safari but .wav / .mp4 files didn't seem to be supported in general. It seems like allowing the resource load in this case is the right thing to do.
To change this from a spec perspective, we could somehow tag the resource load as being associated with the top-level navigation and thus exempt from partitioning, although we might have to pass that value through a lot of layers and it seems more difficult to implement this (at least in Chromium). Alternatively, we could allow unpartitioned blob URL resource loads by first-party contexts when the resource blob URL being loaded equals the URL of the document itself. It seems intuitive to me that a blob URL document should be able to fetch itself regardless of which context it was created in.
WDYT? +CC @mkruisselbrink @annevk @artines1
See also: https://crbug.com/426787402
[1] https://html.spec.whatwg.org/multipage/document-lifecycle.html#read-media