Enable opaque origins for data URLs in Web Workers

Policy ID
DataUrlInWebWorkerOpaqueOriginEnabled
Scope
Computer Configuration, User Configuration
Supported on
Microsoft Edge version 149, Windows 7 or later
Source
Microsoft Edge Policy Templates (version 155.0.4283.45)
Category
Microsoft Edge

Description

This policy controls whether Web Workers created from data URLs are assigned
a unique opaque origin.

Web Workers can be created using a data URL that contains the worker script.
Previously, these workers inherited the origin of the page that created them,
which allowed them to access the same origin-bound data, such as local
storage and cookies.

Starting in Microsoft Edge version
149, Web Workers created from data URLs are assigned a unique opaque origin
by default. This behavior improves security and aligns with the HTML
specification by isolating these workers from the page that created them.

If you enable this policy or don't configure it, Web Workers created from
data URLs are assigned a unique opaque origin.

If you disable this policy, Web Workers created from data URLs inherit the
origin of the page that created them. Use this setting only as a temporary
mitigation for compatibility issues with internal applications that depend
on the legacy behavior.

This policy is temporary and will be removed in Microsoft Edge
version 157.

Registry

ComputerHKEY_LOCAL_MACHINE
  • DataUrlInWebWorkerOpaqueOriginEnabledREG_DWORD
UserHKEY_CURRENT_USER
  • DataUrlInWebWorkerOpaqueOriginEnabledREG_DWORD

Other policies in the same category

View all policies in this category (438)