Request for Mozilla Position on an Emerging Web Specification

• Specification Title: HTML
• Specification or proposal URL:
  • https://html.spec.whatwg.org/multipage/system-state.html#safelisted-scheme (current text)
  • Update safelisted decentralized schemes for registerProtocolHandler() whatwg/html#5482 (decentralized schemes)
  • Add doi as safelisted scheme for the registerProtocolHandler() method whatwg/html#3080 (doi scheme)
  • Add otpauth as a safelisted scheme for registerProtocolHandler() whatwg/html#5551 (otpauth scheme)
• Caniuse.com URL (optional):
  https://caniuse.com/#feat=mdn-api_navigator_registerprotocolhandler
• Bugzilla URL (optional):
  https://bugzilla.mozilla.org/show_bug.cgi?id=1631446
• Mozillians who can provide input (optional): @annevk, @asutherland

Other information

In the past years, the web developer community have requested to add new
schemes to registerProtocolHandler() but decisions have been blocked on
[blocklist] on which some Mozilla members had concerns. Instead, this proposal
is about extending the safelist.

Some Chromium members also had more specific concerns on new schemes
which have not been addressed yet by reporters [geo] [version-control].
The three proposals listed above is about extending the safelist for requests that
seemed uncontroversial in past discussions. More specifically:

1. Those related to decentralized technologies:
   "ethereum", "dat", "dweb", "ipfs", "ipns", "ssb", "cabal" and "hyper".
   Note that the cryptocurrency "bitcoin" is already listed.
   It seems Mozilla had interest in these technologies in the past e.g.
   in [mozilla-webextension], [mozilla-hacks-dweb] or [mozilla-libdweb].
   Note that one mild concern is what happens if some of these decentralized
   protocols are implemented natively. See
   Update safelisted decentralized schemes for registerProtocolHandler() whatwg/html#5482 (comment)

2. Schemes used to encode credentials or id as an URI: "otpauth" and "doi".
   At least for the latter @annevk said Mozilla would accept patches for it:
   Add doi as safelisted scheme for the registerProtocolHandler() method whatwg/html#3080 (comment)

Another concern raised during WHATWG review is the need to ensure these
schemes are documented somewhere, which has been addressed by
registering all of them at [iana].

[blocklist] whatwg/html#3998
[geo] whatwg/html#2546 (comment)
[iana] https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
[mozilla-hacks-dweb] https://hacks.mozilla.org/category/dweb
[mozilla-libdweb] https://github.com/mozilla/libdweb
[mozilla-webextension] https://bugzilla.mozilla.org/show_bug.cgi?id=1428446
[version-control] whatwg/html#1829 (comment)