{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/111","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/111/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/111/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/111/events","html_url":"https://github.com/whatwg/fetch/issues/111","id":101595789,"number":111,"title":"Handling of data URLs","user":{"login":"hiroshige-g","id":11661256,"avatar_url":"https://avatars.githubusercontent.com/u/11661256?v=3","gravatar_id":"","url":"https://api.github.com/users/hiroshige-g","html_url":"https://github.com/hiroshige-g","followers_url":"https://api.github.com/users/hiroshige-g/followers","following_url":"https://api.github.com/users/hiroshige-g/following{/other_user}","gists_url":"https://api.github.com/users/hiroshige-g/gists{/gist_id}","starred_url":"https://api.github.com/users/hiroshige-g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hiroshige-g/subscriptions","organizations_url":"https://api.github.com/users/hiroshige-g/orgs","repos_url":"https://api.github.com/users/hiroshige-g/repos","events_url":"https://api.github.com/users/hiroshige-g/events{/privacy}","received_events_url":"https://api.github.com/users/hiroshige-g/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/whatwg/fetch/labels/needsinfo","name":"needsinfo","color":"bfe5bf"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":32,"created_at":"2015-08-18T07:59:04Z","updated_at":"2016-09-30T12:12:34Z","closed_at":"2016-01-08T15:16:58Z","body":"Hi,\r\nI encountered some questions while I'm implementing Fetch API + data scheme in Chromium/Blink.\r\n\r\nQuestion 1: Are XHRs to data URLs intentionally prohibited, or just XHR's spec lacks same-origin data-URL flag setting or so?\r\n\r\n(I expect the latter because I thought previously we could use XHRs to data URLs)\r\n\r\nFetch API + data URLs: fetch('data://...') is resolved for all modes because same-origin data-URL flag is set in Request() constructor.\r\nHowever, all XHRs to 'data://...' are rejected according to the spec [https://xhr.spec.whatwg.org/], because same-origin data-URL flag is not set (and the default is \"unset\") and mode is CORS or CORS-with-forced-preflight.\r\n\r\nQuestion 2: What is the intention of unsetting same-origin data-URL flag on redirect? Are redirects from HTTP(S) to data URLs intentionally allowed in no-cors mode?\r\n\r\nExample: fetch('http://example.com/A') where the response from 'http://example.com/A' returns a 'Location: data://...' header.\r\nIn such cases, on redirect, same-origin data-URL flag is unset and thus fetch is rejected, except for when mode is \"no-cors\".\r\nIn \"no-cors\" mode, the case of <request's mode is \"no-cors\"> is applied and opaque response is returned.\r\n\r\nIs \"same-origin data-URL flag\" introduced to forbid redirects to data URLs in general?\r\nIf so, such redirects should be rejected also in \"no-cors\" mode.\r\n\r\nRelated Chromium bugs:\r\n  Redirects to data URLs are intentionally forbidden in Chromium\r\n  (so perhaps redirects to data URLs in Fetch API will be also rejected):\r\n    https://code.google.com/p/chromium/issues/detail?id=64092\r\n    https://code.google.com/p/chromium/issues/detail?id=272072\r\n  Implementing Fetch API + data URLs:\r\n    https://code.google.com/p/chromium/issues/detail?id=521475\r\n"},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/250729323","html_url":"https://github.com/whatwg/fetch/issues/111#issuecomment-250729323","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/111","id":250729323,"user":{"login":"youennf","id":5575980,"avatar_url":"https://avatars.githubusercontent.com/u/5575980?v=3","gravatar_id":"","url":"https://api.github.com/users/youennf","html_url":"https://github.com/youennf","followers_url":"https://api.github.com/users/youennf/followers","following_url":"https://api.github.com/users/youennf/following{/other_user}","gists_url":"https://api.github.com/users/youennf/gists{/gist_id}","starred_url":"https://api.github.com/users/youennf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/youennf/subscriptions","organizations_url":"https://api.github.com/users/youennf/orgs","repos_url":"https://api.github.com/users/youennf/repos","events_url":"https://api.github.com/users/youennf/events{/privacy}","received_events_url":"https://api.github.com/users/youennf/received_events","type":"User","site_admin":false},"created_at":"2016-09-30T12:12:34Z","updated_at":"2016-09-30T12:12:34Z","body":"data URLs is the only case I encountered. I would restrict the issue to that scheme.\r\nWould probably be good to do further checks for completeness."}}
{"actor":{"display_login":"youennf"}}