Closed Bug 699857 Opened 12 years ago Closed 12 years ago

Workers: Allow data urls


(Core :: DOM: Core & HTML, defect)

Windows 7
Not set





(Reporter: bent.mozilla, Assigned: bent.mozilla)


(Depends on 1 open bug)


(Keywords: dev-doc-complete)


(1 file)

Attached patch Patch, v1Splinter Review
We should allow data URLs to make workers. Patch attached.
Attachment #572019 - Flags: review?(jonas)
Closed: 12 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Target Milestone: --- → mozilla10
Why we are going to allow data URL Workers while the spec explicitly disallows?
Is a spec change proposed somewhere? If it is, please let me know the pointer.
I don't mind allowing in itself so much because we (and even Chrome) already allow Blob URL Workers.
In Gecko data-urls have always been considered same-origin, so in a way we are actually complying with the spec.

The origin of data urls is something that is still being debated in the spec world, so I don't think we should make a departure from our usual behavior here.
(In reply to Jonas Sicking (:sicking) from comment #6)
> In Gecko data-urls have always been considered same-origin, so in a way we
> are actually complying with the spec.

"origin" definition of HTML spec is:
| The term origin is used per its definition in the Origin specification.

And in the Origin specification, data URIs are defined as "globally unique identifiers" and cannot be same-origin with any domains.
| A globally unique identifier is a value which is different from all
| other previously existing values.  For example, a sufficiently long
| random string is likely to be a globally unique identifier.
| data URIs do not use a server-based naming authority and therefore have
| globally unique identifiers as origins.

So I think it's better to update the spec.
The draft has been expired in May 30, 2011.
I've updated : and

I did mention the disagreement about whether a data URI is valid under the same-origin policy or not.

I didn't made any changes to as we don't list any usage there.

Is there a bug opened at the WhatWG/W3C to fix the documentation to explicitly allow dataURI? It would be helpful for me to follow it to know if/when the specs are changed to update the doc w/ this information.
Depends on: 716820
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.