Closed domfarolino closed 2 months ago
cc @hsivonen
I believe this would be consistent with Gecko principal inheritance into about:blank (in the light of new developments at https://bugzilla.mozilla.org/show_bug.cgi?id=1753352 ), so I think a positive position on this makes sense.
Request for Mozilla Position on an Emerging Web Specification
Chromium would like to implement snapshotting of what is now the "fallback base URL" for
about:blank
andabout:srcdoc
iframes and popup windows. Furthermore, because a document's "creator" can be different from its navigation "initiator", we've picked the initiator as the document from which anabout:srcdoc
/about:blank
document's base URL is to be inherited, for consistency. We've received informally positive comments about these changes from WebKit folks and many others, so we are continuing to gather formal opinions here.The current fallback base URL mechanism expects to be able to:
about:srcdoc
iframesabout:blank
popupsBad side-effects of the current spec
We, and many others involved in discussions over the years, believe this has bad side-effects: - It makes it harder to move things like sandboxed `srcdoc` iframes out-of-process, since one must synchronize the parent/creator's live URL across processes to simulate the current spec - It violates some security and/or privacy expectations of frame sandboxing, which ideally should under no circumstances be able to spy on an embedder frame's live URL - The current spec seems broken in related ways. For example, the creator frame **A** (reached into by the "creator base URL" algorithm) can be gone by the time a frame it creates **B** runs its "fallback base URL", which expects **A** to be around - Being able to observe dynamic updates to another frame's live, potentially out-of-process, URL is tricky & potentially racyMany related spec issues have been filed and discussed over the years, and our proposal can be found in https://github.com/whatwg/html/issues/421#issuecomment-1260360824. This is not a formal specification, but I've volunteered to write one in the coming weeks so stay tuned. However we'd love to hear whether WebKit is generally supportive of the direction of snapshotting a base URL. Our specific proposal can be condensed into the following observable effects:
about:blank
; in our proposal, B inherits A's base URL, instead of "dynamically" pointing to its parent's, which could be different. We'd like to make origin inheritance behave like this, too.Please see this detailed table of the current cross-browser behavior of what we're changing, and our proposed behavior for each scenario: https://docs.google.com/document/d/1Cy6kuOEuYflHWKK-uQ5bU1x6wEDvyGncgJHChF1PG-U/edit?resourcekey=0-f0zbSZ9mwGyXDSqDCqjicw.
/cc @wjmaclean & @csreis