#52822: fix: return opaque responses from file and http protocol handlers for cross-origin no-cors requests
Merged
Created: Aug 15, 2026, 4:19:41 PM
Merged: Aug 16, 2026, 5:55:41 AM
5 comments
Target: main
Custom schemes registered with supportFetchAPI: true but without corsEnabled: true should return an opaque response to a cross-origin fetch(url, { mode: 'no-cors' }), the same as protocol.handle. The response was only tagged opaque on the string/buffer/stream path — registerFileProtocol and registerHttpProtocol delivered a readable (basic) response instead.
- Compute the opaque-response decision once in
ElectronURLLoaderFactory::StartLoadingand thread it into the file and http loaders. - Tag the delivered response head
kOpaqueon the file and http paths via a smallURLLoaderClientinterposer, soasar, the plain file loader, andURLPipeLoaderall match the buffer/stream path. - Add protocol spec coverage for
registerFileProtocolandregisterHttpProtocolcross-originno-corsfetches.
Notes: Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron