Similar to sandboxed iframes and data: URLs, treat file:// URLs as having unique origin.

Specification

Specification link


Final published standard: Recommendation, Living Standard, Candidate Recommendation, or similar final form

Status in Chromium

Blink


Enabled by default (tracking bug)

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • No signal
  • No signal
  • No signals

Owners

Comments

There will be some visible side effects when opening documents via a file:// URL. For example - a file:// URL will no longer be able to XHR itself - two subframes navigated to the same file:// URL will no longer be able to script each other synchronously. The rationale behind this proposal is that using a filename as the security principal can be dangerous. There is no guarantee from an OS filesystem that a given filename always points to a unique object.

Search tags

file url, origin, security origin, security,

Last updated on 2020-11-09