Limit registerProtocolHandler() url argument to http/https

Security

Limits registerProtocolHandler() to only accept URLs with http or https as the schema. This is because it doesn't make much sense for handlers to be data URLs, blob URLs, or whatever. The guidance on https://developer.mozilla.org/en-US/docs/Web/API/Navigator/registerProtocolHandler states: 'The handler's URL must use one of "http" or "https" as its scheme.' The spec lets implementers to add additional checks like this https://html.spec.whatwg.org/multipage/system-state.html#custom-handlers

Specification

De-facto standard

Status in Chromium

Blink>HTML>CustomHandlers


Enabled by default (tracking bug) in:

  • Chrome for desktop release 77

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Shipped
  • No public signals
  • No public signals
  • No signals

Owner

Last updated on 2019-07-10