Why is Access to `cssRules` Denied from Local CSS Files in Chrome 64?

Access to cssRules Denied from Local CSS Files in Chrome 64

Issue: Why is access to cssRules from a CSS stylesheet loaded from the local filesystem denied in Chrome 64?

Cause: Chrome 64 introduced security changes that enforce Cross-Origin Resource Sharing (CORS) policies. Accessing CSS rules from a local stylesheet violates this policy, resulting in access being denied.

Workarounds:

1. Use an online/localhost hosting environment: Running the code from a web server or localhost environment allows the CSS file to be accessed via CORS-compliant channels.
2. Use other browsers: Browsers such as Internet Explorer, Microsoft Edge, and Firefox currently do not enforce CORS policies for local CSS files.
3. Use the command line flag: The command line flag chrome --allow-file-access-from-files temporarily disables CORS enforcement, allowing access to CSS rules from local files. This workaround is not recommended for general use.

Explanation:

The updated behavior aligns with the CSS Object Model specification, which requires same-origin access for certain CSS operations. This security measure prevents unauthorized modification of cross-origin stylesheets.

Current Status:

The introduced security changes have sparked some debate. Open issues include detection methods for restricted access and potential implementation issues that affect workarounds. The specification is still under development, so the long-term implications may vary.

The above is the detailed content of Why is Access to `cssRules` Denied from Local CSS Files in Chrome 64?. For more information, please follow other related articles on the PHP Chinese website!