25091 2014-03-18 15:47:47 +0000 [imports]: Want to be used with data: URL scheme 2015-04-17 16:35:14 +0000 1 1 1 Unclassified WebAppsWG HISTORICAL - Component Model unspecified PC Linux RESOLVED INVALID P2 normal --- 20683 1 morrita dglazkov annevk erik.arvidsson mike philipj public-webapps public-webapps-bugzilla oldest_to_newest 102570 0 morrita 2014-03-18 15:47:47 +0000 Currently we cannot use (or aren't clear if we can use) data: URL. This is because the origin of data: URL isn't clearly defined. In Blink/WebKit, I believe it has its own origin. And AFAIK there is no way to do CORS request against data: URL. 102572 1 annevk 2014-03-18 15:55:36 +0000 Yes there is. Per http://fetch.spec.whatwg.org/ a data URL will return a response that isn't tainted. It might take some time for everyone to get on board with this architecture but given service workers I think this is the way to go. 102575 2 morrita 2014-03-18 17:07:31 +0000 (In reply to Anne from comment #1) > Yes there is. Per http://fetch.spec.whatwg.org/ a data URL will return a > response that isn't tainted. > > It might take some time for everyone to get on board with this architecture > but given service workers I think this is the way to go. Thanks for the feedback Anne! So based on the spec, it seems data:// URL should return the response. because it doesn't set response tainting mode and the basic fetch algorithm doesn't see CORS related flags for data: url. That means the imports spec doesn't have to take care of it. 119639 3 dglazkov 2015-04-17 14:43:09 +0000 Philip mentioned something on https://code.google.com/p/chromium/issues/detail?id=350741 about re-opening this bug. 119640 4 philipj 2015-04-17 16:35:14 +0000 Oh, that was poorly phrased, my guess was that the Chromium bug ought to be re-opened. In any event, the spec and Blink now seem to disagree, so I think one of the bugs ought to be re-opened.