1216849 - support XMLHttpRequest from file:// protocol to websites

Status: RESOLVED DUPLICATE of bug 424875

(Core :: DOM: Core & HTML, enhancement)

Description

[sworddragon2]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20151016093648



Actual results:

Firefox (and other browsers) are restricting several actions sites can do (like making easily AJAX requests to any site) for security reasons. This may be fine for remote content (like http(s)://) to prevent it doing malicious things but I'm thinking about how much of this should apply to local content (file://).


Expected results:

Users have to explicitly start local applications (file://) so they are similar to native system applications that have wide permissions. Do we really need things like restricting cross domain requests to prevent local web applications fetching any data independent of the server configuration? I fail to find a plausible reason for this. Lowering the restrictions for the file-protocol may also make Firefox/browsers a more attractive platform for developing local HTML5/modern applications.

Comment 2

[Dirkjan Ochtman (:djc)]

I think this is a good discussion to have, but Bugzilla is probably not the best venue for it. Maybe you can start a mailing list discussion; I think the dev-platform list could be a good fit:

https://lists.mozilla.org/listinfo/dev-platform

Comment 3

[sworddragon2]

(In reply to Sebastian H. [:aryx][:archaeopteryx] from comment #1)
> 
> *** This bug has been marked as a duplicate of bug 424875 ***

This ticket is not a direct duplicate (possibly more like a meta ticket) as it keeps in mind all potential restricting aspects (but XMLHttpRequest may be currently indeed the biggest problem).


(In reply to Dirkjan Ochtman (:djc) from comment #2)
> I think this is a good discussion to have, but Bugzilla is probably not the
> best venue for it. Maybe you can start a mailing list discussion; I think
> the dev-platform list could be a good fit:
> 
> https://lists.mozilla.org/listinfo/dev-platform

Personally I don't like mailing lists that much and since this is basically a feature request a discussion here should be more or less fine. But for now I will wait how the other ticket advances.