Data URLs
, URLs prefixed with the
data:
scheme, allow content creators to embed small files inline in documents. They were formerly known as "data URIs" until that name was retired by the WHATWG.
注意 : Data URLs are treated as unique opaque origins by modern browsers, rather than inheriting the origin of the settings object responsible for the navigation.
Data URLs are composed of four parts: a prefix (
data:
), a
MIME type
indicating the type of data, an optional
base64
token if non-textual, and the data itself:
data:[<mediatype>][;base64],<data>
mediatype
是
MIME type
string, such as
'image/jpeg'
for a JPEG image file. If omitted, defaults to
text/plain;charset=US-ASCII
If the data is textual, you can simply embed the text (using the appropriate entities or escapes based on the enclosing document's type). Otherwise, you can specify
base64
to embed base64-encoded binary data. You can find more info on MIME types
here
and
here
.
A few examples:
data:,Hello%2C%20World!
data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==
base64-encoded version of the above
data:text/html,%3Ch1%3EHello%2C%20World!%3C%2Fh1%3E
<h1>Hello, World!</h1>
data:text/html,<script>alert('hi');</script>
An HTML document that executes a JavaScript alert. Note that the closing script tag is required.
Base64 is a group of binary-to-text encoding schemes that represent binary data in an ASCII string format by translating it into a radix-64 representation. By consisting only in ASCII characters, base64 strings are generally url-safe, and that's why they can be used to encode data in Data URLs.
The Web APIs have native methods to encode or decode to base64: Base64 encoding and decoding .
Base64 encoding of a file or string on Linux and Mac OS X systems can be achieved using the command-line
base64
(or, as an alternative, the
uuencode
utility with
-m
argument).
echo -n hello|base64 # outputs to console: aGVsbG8= echo -n hello>a.txt base64 a.txt # outputs to console: aGVsbG8= base64 a.txt>b.txt # outputs to file b.txt: aGVsbG8=
Encoding on Windows can be done through powershell or some dedicated tool. It can even be done via bash
base64
utility (see section Encoding on a Unix system) if
WSL
is activated.
[convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("hello"))
# outputs to console: aGVsbG8=
bash -c "echo -n hello`|base64"
# outputs to console: aGVsbG8=
# the backtick (`) is used to escape the piping (|) character here
This section describes problems that commonly occur when creating and using
data
URLs.
data:text/html,lots of text...<p><a name%3D"bottom">bottom</a>?arg=val
This represents an HTML resource whose contents are:
lots of text...<p><a name="bottom">bottom</a>?arg=val
data
URLs is very simple, but it's easy to forget to put a comma before the "data" segment, or to incorrectly encode the data into base64 format.
data
URL provides a file within a file, which can potentially be very wide relative to the width of the enclosing document. As a URL, the
data
should be formatable with whitespace (linefeed, tab, or spaces), but there are practical issues that arise
when using base64 encoding
.
data
URLs of essentially unlimited length, browsers are not required to support any particular maximum length of data. For example, the Opera 11 browser limited URLs to 65535 characters long which limits
data
URLs to 65529 characters (65529 characters being the length of the encoded data, not the source, if you use the plain
data:
, without specifying a MIME type).
'base64'
, are ignored, but no error is provided.
The data portion of a data URL is opaque, so an attempt to use a query string (page-specific parameters, with the syntax
<url>?parameter-data
) with a data URL will just include the query string in the data the URL represents.
data://
URLs has been blocked in Firefox 59+ (release version, Nightly/Beta from 58), and we hope to see other browsers follow suit soon.
See Blocking Top-Level Navigations to data URLs for Firefox 58
了解更多细节。
| 规范 | Title |
|---|---|
| RFC 2397 | The "data" URL scheme |
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| data URL scheme | Chrome 完整支持 Yes |
Edge
完整支持
12
注意事项
|
Firefox 完整支持 Yes |
IE
完整支持
8
注意事项
|
Opera 完整支持 7.2 | Safari 完整支持 Yes | WebView Android 完整支持 Yes | Chrome Android 完整支持 Yes | Firefox Android 完整支持 Yes | Opera Android 完整支持 Yes | Safari iOS 完整支持 Yes | Samsung Internet Android 完整支持 Yes |
| CSS files | Chrome 完整支持 Yes |
Edge
完整支持
12
注意事项
|
Firefox 完整支持 Yes |
IE
完整支持
8
注意事项
|
Opera 完整支持 7.2 | Safari 完整支持 Yes | WebView Android 完整支持 Yes | Chrome Android 完整支持 Yes | Firefox Android 完整支持 Yes | Opera Android 完整支持 Yes | Safari iOS 完整支持 Yes | Samsung Internet Android 完整支持 Yes |
| HTML files | Chrome 完整支持 Yes | Edge 完整支持 79 | Firefox 完整支持 Yes | IE 不支持 No | Opera 完整支持 Yes | Safari 完整支持 Yes | WebView Android 完整支持 Yes | Chrome Android 完整支持 Yes | Firefox Android 完整支持 Yes | Opera Android 完整支持 Yes | Safari iOS 完整支持 Yes | Samsung Internet Android 完整支持 Yes |
| JavaScript files | Chrome 完整支持 Yes |
Edge
完整支持
12
注意事项
|
Firefox 完整支持 Yes |
IE
完整支持
9
注意事项
|
Opera 完整支持 7.2 | Safari 完整支持 Yes | WebView Android 完整支持 Yes | Chrome Android 完整支持 Yes | Firefox Android 完整支持 Yes | Opera Android 完整支持 Yes | Safari iOS 完整支持 Yes | Samsung Internet Android 完整支持 Yes |
| Top-level navigation blocked to data:// URIs | Chrome 完整支持 60 | Edge 完整支持 ≤79 | Firefox 完整支持 59 | IE 不支持 No | Opera 完整支持 47 | Safari ? | WebView Android 不支持 No | Chrome Android 完整支持 60 | Firefox Android 完整支持 59 | Opera Android 完整支持 44 | Safari iOS ? | Samsung Internet Android 完整支持 8.0 |
完整支持
不支持
兼容性未知
见实现注意事项。
Accept
Accept-CH
Accept-CH-Lifetime
Accept-Charset
Accept-Encoding
Accept-Language
Accept-Patch
Accept-Ranges
Access-Control-Allow-Credentials
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Origin
Access-Control-Expose-Headers
Access-Control-Max-Age
Access-Control-Request-Headers
Access-Control-Request-Method
Age
Allow
Alt-Svc
Authorization
Cache-Control
Clear-Site-Data
Connection
Content-Disposition
Content-Encoding
Content-Language
Content-Length
Content-Location
Content-Range
Content-Security-Policy
Content-Security-Policy-Report-Only
Content-Type
Cookie
Cookie2
Cross-Origin-Embedder-Policy
Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy
DNT
DPR
Date
Device-Memory
Digest
ETag
Early-Data
Expect
Expect-CT
Expires
Feature-Policy
Forwarded
From
Host
If-Match
If-Modified-Since
If-None-Match
If-Range
If-Unmodified-Since
索引
Keep-Alive
Large-Allocation
Last-Modified
Link
Location
NEL
Origin
Pragma
Proxy-Authenticate
Proxy-Authorization
Public-Key-Pins
Public-Key-Pins-Report-Only
Range
Referer
Referrer-Policy
Retry-After
Save-Data
Sec-Fetch-Dest
Sec-Fetch-Mode
Sec-Fetch-Site
Sec-Fetch-User
Sec-WebSocket-Accept
Server
Server-Timing
Set-Cookie
Set-Cookie2
SourceMap
Strict-Transport-Security
TE
Timing-Allow-Origin
Tk
Trailer
Transfer-Encoding
Upgrade-Insecure-Requests
User-Agent
Vary
Via
WWW-Authenticate
Want-Digest
警告
X-Content-Type-Options
X-DNS-Prefetch-Control
X-Forwarded-For
X-Forwarded-Host
X-Forwarded-Proto
X-Frame-Options
X-XSS-Protection
100 Continue
101 Switching Protocols
103 Early Hints
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial Content
300 Multiple Choices
301 Moved Permanently
302 Found
303 See Other
304 Not Modified
307 Temporary Redirect
308 Permanent Redirect
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Payload Too Large
414 URI Too Long
415 Unsupported Media Type
416 Range Not Satisfiable
417 Expectation Failed
418 I'm a teapot
422 Unprocessable Entity
425 Too Early
426 Upgrade Required
428 Precondition Required
429 Too Many Requests
431 Request Header Fields Too Large
451 Unavailable For Legal Reasons
500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
505 HTTP Version Not Supported
506 Variant Also Negotiates
507 Insufficient Storage
508 Loop Detected
510 Not Extended
511 Network Authentication Required
CSP: base-uri
CSP: block-all-mixed-content
CSP: child-src
CSP: connect-src
CSP: default-src
CSP: font-src
CSP: form-action
CSP: frame-ancestors
CSP: frame-src
CSP: img-src
CSP: manifest-src
CSP: media-src
CSP: navigate-to
CSP: object-src
CSP: plugin-types
CSP: prefetch-src
CSP: referrer
CSP: report-to
CSP: report-uri
CSP: require-sri-for
CSP: sandbox
CSP: script-src
CSP: script-src-attr
CSP: script-src-elem
CSP: style-src
CSP: style-src-attr
CSP: style-src-elem
CSP: trusted-types
CSP: upgrade-insecure-requests
CSP: worker-src