171666 2017-05-04 09:25:53 -0700 CORS execution from file:// scheme not allowed by default in STP 29 2017-05-12 08:48:56 -0700 1 1 1 Unclassified WebKit JavaScriptCore Safari Technology Preview Mac macOS 10.12 RESOLVED INVALID P2 Normal --- 1 d.i.richardson webkit-unassigned bfulgham dbates jond oldest_to_newest 1304658 0 309055 d.i.richardson 2017-05-04 09:25:53 -0700 Created attachment 309055 A simple html file with XHR to fetch and display http://webkit.org Beginning with Safari Technology Preview release 29, all CORS requests from file:// are blocked unless Disable Local File Restrictions or Disable Cross-Origin Restrictions selected from Develop menu. This behaviour is new, and not present in release versions of Safari or Webkit Nightly r216177. Load attached file in browser to test. 1304665 1 dbates 2017-05-04 09:43:19 -0700 As it turns out the behavior change is intentional. In STP 29 we changed Develop > Disable Local File Restrictions to toggle granting universal access for non-quarantined file URLs. Formerly file URLs for non-quarantined files would be granted universal access by default and Develop > Disable Local File Restrictions did nothing. So, to opt into the old behavior enable Disable Local File Restrictions. 1304666 2 dbates 2017-05-04 09:44:06 -0700 We should update the STP 29 release notes to mention the behavior change. 1304667 3 dbates 2017-05-04 09:46:04 -0700 For Apple employees, see <rdar://problem/30383804> for more details on this change in behavior. 1307886 4 bfulgham 2017-05-12 08:48:56 -0700 Note that WebKit's behavior for this now matches Chrome and Firefox. 309055 2017-05-04 09:25:53 -0700 2017-05-04 09:25:53 -0700 A simple html file with XHR to fetch and display http://webkit.org CORS Test.html text/html 699 d.i.richardson PCFET0NUWVBFIGh0bWw+CjxodG1sPgogICAgPGJvZHk+CiAgICAgICAgPGgyPlRlc3QgQ09SUyBm cm9tIGZpbGU6Ly88L2gyPgogICAgICAgIDxkaXYgaWQ9ImRlbW8iPgogICAgICAgICAgICA8YnV0 dG9uIHR5cGU9ImJ1dHRvbiIgb25jbGljaz0ibG9hZFhNTERvYygpIj5GZXRjaCBodHRwOi8vd2Vi a2l0Lm9yZzwvYnV0dG9uPgogICAgICAgIDwvZGl2PgogICAgICAgIDxzY3JpcHQ+CiAgICAgICAg ICAgIGZ1bmN0aW9uIGxvYWRYTUxEb2MoKSB7CiAgICAgICAgICAgICAgICB2YXIgeGh0dHAgPSBu ZXcgWE1MSHR0cFJlcXVlc3QoKTsKICAgICAgICAgICAgICAgIHhodHRwLm9ucmVhZHlzdGF0ZWNo YW5nZSA9IGZ1bmN0aW9uKCkgewogICAgICAgICAgICAgICAgaWYgKHRoaXMucmVhZHlTdGF0ZSA9 PSA0ICYmIHRoaXMuc3RhdHVzID09IDIwMCkgewogICAgICAgICAgICAgICAgICAgIGRvY3VtZW50 LmdldEVsZW1lbnRCeUlkKCJkZW1vIikuaW5uZXJIVE1MID0KICAgICAgICAgICAgICAgICAgICB0 aGlzLnJlc3BvbnNlVGV4dDsKICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgfTsKICAgICAg ICAgICAgeGh0dHAub3BlbigiR0VUIiwgImh0dHA6Ly93ZWJraXQub3JnIiwgdHJ1ZSk7CiAgICAg ICAgICAgIHhodHRwLnNlbmQoKTsKICAgICAgICAgICAgfQogICAgICAgIDwvc2NyaXB0PgogICAg PC9ib2R5Pgo8L2h0bWw+