1289387 - Follow up fixes to sendBeacon()'s request mode

Status: NEW

(Core :: DOM: Networking, defect, P3)

Description

[Anne (:annevk)]

In bug 1280692 we are changing the default request mode for sendBeacon() to "no-cors", falling back to "cors" for Blobs.

https://github.com/w3c/beacon/pull/34 changes the sendBeacon() standard to switch on the MIME type of the content rather than special casing blobs.

Now while we might want to further change to align with that, another problem here is https://bugs.chromium.org/p/chromium/issues/detail?id=490015 which indicates that Chrome always uses "cors" and therefore does not protect servers against malicious Content-Type headers. So maybe we want to wait until that is resolved before making the "final" decision on sendBeacon()'s security policy.

Comment 1

[Anne (:annevk)]

Correction: Chrome always uses "no-cors", doh.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Yeah, for some reason the Google engineers have been really nonchalant about fixing that bug, which is quite strange given that it's a security bug. I would not expect that Chrome will switch to enforcing CORS correctly anytime soon. And they might never if they run into web-compat problems, which is certainly not impossible.

Comment 5

[Tom Ritter [:tjr]]

Is this unblocked now that it seems Chrome has fixed their issue?

Comment 6

[Anne (:annevk)]

Yeah this would be good to fix.