COEP shouldn't take effect in data URL frames.

[yutakahirano]

Related to whatwg/html#4930.

[yutakahirano]

Chrome and Firefox pass the current test, which means they will fail with this change.

I'm puzzled by the Firefox behavior because they pass no-secure-context.html.

[annevk]

What's the basis for making this change? data: URLs are a secure context. If they do not enforce the policy you could have a way to smuggle non-cross-origin isolated data into a cross-origin isolated process, no?

[yutakahirano]

I saw old comments such as whatwg/html#5198 (comment) and the (current) Chromium implementation and thought that data URLs are not secure contexts.

But you changed the spec after that, right? w3c/webappsec-secure-contexts#69 w3c/webappsec-secure-contexts#72

[annevk]

Yeah, I did. I'll update the comment in that issue.

[yutakahirano]

Thanks!