6476 2009-01-27 14:23:20 +0000 cross-origin media element loads and progress events 2010-10-04 14:55:27 +0000 1 1 1 Unclassified HTML WG pre-LC1 HTML5 spec (editor: Ian Hickson) unspecified All All VERIFIED FIXED NoReply P2 normal --- 1 annevk ian mike public-html-admin public-html-wg-issue-tracking public-html-bugzilla oldest_to_newest 23255 0 annevk 2009-01-27 14:23:20 +0000 Media elements currently allow for cross-origin loads without explicit opt in from the server they are requested from. So far this is similar to the img element and ok. However, progress events are not limited in any way exposing more information about the file on the other end than has been possible so far with cross-origin loads. That information needs to be restricted somehow. Most likely by using CORS as defense mechanism. 23380 1 ian 2009-02-02 11:05:40 +0000 (this is pending on progress events feedback) 33045 2 mjs 2010-03-14 13:16:30 +0000 This bug predates the HTML Working Group Decision Policy. If you are satisfied with the resolution of this bug, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html This bug is now being moved to VERIFIED. Please respond within two weeks. If this bug is not closed, reopened or escalated within two weeks, it may be marked as NoReply and will no longer be considered a pending comment.