1342407 - html5 "download" attribute restrictions makes it almost useless

Status: RESOLVED DUPLICATE of bug 923415

(Core :: DOM: Core & HTML, defect)

Description

[Owyn Tyler]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131

Steps to reproduce:

HTML5 feature <a download> which works freely in other browsers (Chrome e.g.) have same-origin strict restriction in Firefox enforced making it practically useless cause most files nowadays are hosted on CDN servers and firefox disallow access even to subdomains on the same root domain, e.g.:

webpage: domain.com
file: files84.domain.com
result: download HTML5 attribute dissallowed

live example: http://fastpic.ru image hosting, - just upload any image to it, it would be hosted on a http://i72.fastpic.ru website, so if we try to add a HTML5 download button to it from main website - it would not work in firefox 


Actual results:

download doesn't work


Expected results:

it should work, it does work in Chrome, it makes barely any sense not to work

Comment 1

[Andrew Overholt [:overholt]]

Looks like this restriction may have been added in bug 850378 by Ian and reviewed by Justin so I'm needinfoing them here.

Comment 2

[Justin Dolske [:Dolske]]

Someone more DOMmy should confirm what's actually expected here. Olli did the review in bug 676619, which bug 850378 comment 27 points to as having specified this. I have a dim recollection of it being about preventing badness from <a download=foo.exe href=xo.com/kitten.jpg> types of things, but I dunno.

Perhaps what was actually intended was to ignore the attribute _value_ (filename), but still force a download (instead of display)? So with <a download=foo.exe href=kitten.jpg> instead of viewing kitten.jpg, you should end up downloading kitten.jpg (and not foo.exe)?

Comment 3

[Ian Moody [:Kwan] (UTC+0)]

Gah, mid-aired.

This was actually a pre-existing restriction from the original [download] implementation, bug 676619 (bug 850378 just made it work in right-click case).

Bug 923415 is for relaxing the same-origin restriction so duping.