Isn’t this privacy tradeoff directly at odds with security? i.e. local access would also open the door to malicious sites accessing the local file system?

I can understand the dev-time frustration with CORS, but removing it just reintroduces a whole category of security issues.

Maybe there is something better, but whatever replaces it would need to include similar restrictions.

But setting that aside, bypassing CORS to achieve this seems analogous to unlocking your front door/gate before leaving for the day in order to grant access to a delivery driver.

It’ll work, and the driver can deliver your package, but it’ll also let random and potentially malicious passers-by into your home without restriction, so who knows if your home will be intact when you return. A theoretically functional solution that doesn’t really work in the real world.

Some other solution that behaves more like a temporary file store sounds better, but the tradeoff I mentioned is specifically about CORS.

I get that you need the user to explicitly select the file but I don’t understand the need to upload to a server.

Couldn’t you ask the user to select the file and just use the file locally, e.g. with the File API? https://developer.mozilla.org/en-US/docs/Web/API/File

I guess things break when you need repeated access and when having to pick the same file multiple times would be bad UX.

In the case I was referring, we loaded files as blobs in the browser's local storage, allowing us to run a web worker as a persistent local cache server.

This involved managing Firefox's admirable response doctoring policies, though.

All other browsers would let a web worker modify the incoming response to a request before forwarding it to an iframe, but FF absolutely refused it and required that the modified response get constructed anew in its local context, meaning locally created or injected content could not be mistakenly trusted as origin content.