2 ms·
> I made it possible to generate a new document by loading, e.g. javascript:'hello, world' It never occurred to me to try, but I think this is still possible e
by derefr 4y ago
> I made it possible to generate a new document by loading, e.g. javascript:'hello, world'
It never occurred to me to try, but I think this is still possible even without the javascript: URI scheme, as there’d be nothing stopping you from putting an inline <script> in an HTML page described by a data: URI, and bookmarking said data: URI.
Not sure what the browser would consider that data: page’s HTTP origin to be for cookie / CORS purposes, though.
- easrng 4y agoData URLs have a null origin and don't count as secure.