Enable opaque origins for data URLs in Web Workers
- Policy ID
- DataUrlInWebWorkerOpaqueOriginEnabled
- Scope
- Computer Configuration, User Configuration
- Supported on
- Microsoft Edge version 149, Windows 7 or later
- Source
- Microsoft Edge Policy Templates (version 155.0.4283.45)
- Category
- Microsoft Edge
Description
This policy controls whether Web Workers created from data URLs are assigned
a unique opaque origin.
Web Workers can be created using a data URL that contains the worker script.
Previously, these workers inherited the origin of the page that created them,
which allowed them to access the same origin-bound data, such as local
storage and cookies.
Starting in Microsoft Edge version
149, Web Workers created from data URLs are assigned a unique opaque origin
by default. This behavior improves security and aligns with the HTML
specification by isolating these workers from the page that created them.
If you enable this policy or don't configure it, Web Workers created from
data URLs are assigned a unique opaque origin.
If you disable this policy, Web Workers created from data URLs inherit the
origin of the page that created them. Use this setting only as a temporary
mitigation for compatibility issues with internal applications that depend
on the legacy behavior.
This policy is temporary and will be removed in Microsoft Edge
version 157.
Registry
- DataUrlInWebWorkerOpaqueOriginEnabledREG_DWORD
- DataUrlInWebWorkerOpaqueOriginEnabledREG_DWORD