New issue
Advanced search Search tips

Issue 673179 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 41024
Owner: ----
Closed: Jan 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

file:// uri's detected as "Cross origin requests" with XHR, even when requesting itself.

Reported by divinit...@gmail.com, Dec 11 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce the problem:
1. 
make a file called test.html in your home folder containing: 

<script>
(function(){
"use strict";
var xhr=new XMLHttpRequest();
xhr.open("GET","test.html");
xhr.addEventListener("readystatechange",function(ev){
var xhr=ev.target;
console.log(xhr.readyState);
console.log(xhr.responseText);
});
xhr.send();
})();
</script>

2. open the file test.html in Chromium, like file:///home/hanshenrik/test.html

What is the expected behavior?
test.html loads itself as expected

What went wrong?
XMLHttpRequest cannot load file:///home/hanshenrik/test.html. Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-extension, https, chrome-extension-resource.

(thrown on xhr.send();)

Did this work before? N/A 

Chrome version: 53.0.2785.143  Channel: beta
OS Version: debian 9, kernel 4.8.7-1
Flash Version: 

it does not work with other files in the same folder either. i originally tried to load a sqlite3 db file over xhr with it. works in firefox, but did not work in chromium
 
Components: -Blink Blink>Network>XHR
Status: Untriaged (was: Unconfirmed)
I can confirm the results presented are accurate. Not 100% certain it is a bug since the W3C spec on what constitutes an origin for files seems to be up to UA's. We should probably clarify the error message if this is intended so it is less confusing to developers.

Firefox's file access policy can be found here [1]. They glob the folder and children as same-origin when using file:// access.

[1] https://developer.mozilla.org/en-US/docs/Same-origin_policy_for_file:_URIs
Mergedinto: 41024
Status: Duplicate (was: Untriaged)

Sign in to add a comment