Thank you, it seems like we should be using "Is url potentially trustworthy?" instead here. (I wonder if we should rename that to "secure URL" both for brevity and for consistency with secure contexts.)

I think it would be good to have Microsoft / Google's opinion on this.

@annevk what is Mozilla's plan for this issue?

I assumed that neither Firefox nor Chrome would want to change this and that therefore it's a specification bug. Unless there's a compelling reason for following the current specification?

For Chromium, the consensus on https://bugs.chromium.org/p/chromium/issues/detail?id=1112268 seems to be that it should be "is url potentially trustworthy" (whatever that means).

To be perfectly clear, that's okay with Firefox.

(whatever that means)

So I just checked what that means according to the latest Secure Contexts draft:
https://w3c.github.io/webappsec-secure-contexts/#is-url-trustworthy
https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy

To summarize:

• about:blank or about:srcdoc
• data:
• https: or wss:
• 127.0.0.0/8, ::1/128
• localhost, .localhost
• file:
• packaged applications schemes (e.g. app: or chrome-extension:)
• any development environment override

Additionally, there is a not saying that blob: and filesystem: created in trustworthy origin will also be potentially trustworthy.

I think this is mostly ok, but allowing "data:" and "blob:" looks suspicious to me. At least Chrome has protocol handler unit tests to check they are not supported. I'm not really sure what "filesystem:" is but given it is non-standard and trustworthy depending on context, I guess it should not be included it in the list of registrable URLs.

I haven't done any experiment though, it's possible that these URLs would be discarded by other security checks anyway.