Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

COOP and multipart/x-mixed-replace #5670

Open
domenic opened this issue Jun 24, 2020 · 2 comments
Open

COOP and multipart/x-mixed-replace #5670

domenic opened this issue Jun 24, 2020 · 2 comments
Labels
topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header topic: navigation

Comments

@domenic
Copy link
Member

domenic commented Jun 24, 2020

From #5334 (comment):

I noticed that multipart/x-mixed-replace also invokes "process a navigate response" and can do so from a top-level browsing context. Those subsequent responses should never be allowed to change COOP+COEP state I think, but this is not specified now. We might also not have test coverage there, because it's in general a somewhat buggy part of the whole navigation algorithm.

@domenic domenic added topic: navigation topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header labels Jun 24, 2020
@jakearchibald
Copy link
Contributor

jakearchibald commented Sep 13, 2021

https://random-server-stuff.glitch.me/multipart-mixed-replace - simple text/plain x-mixed-replace example.

It seems like Firefox rejects the above, Chrome tries to parse it as an image, but Safari parses it properly. It's possible I've gotten the protocol wrong though.

If the results are correct, I think spec'ing one of those makes sense.

The Firefox behaviour is simplest, but fails if you navigate directly to one of those old style 'MJPEG' webcam images. If we care about that, Chrome's behaviour is a good compromise. Safari's behaviour is best if there are resources using x-mixed-replace for non-image resources, but I don't think that's the case.

@jakearchibald
Copy link
Contributor

Hm, I guess Chrome's solution doesn't really help here as it still needs to create a same-origin document for the image.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
topic: cross-origin-opener-policy Issues and ideas around the new "inverse of rel=noopener" header topic: navigation
Development

No branches or pull requests

2 participants