This use case is hitting security restrictions of modern browsers. They surely distinguish "human initiated" events from "artificial" ones and treats them differently when it comes to any spoofing concern. The event chain that browser watches and evaluates can be quite complex, so translating "real" click events and 'proxying' them works (user really clicked something, so it can mean that he intended to make some action), but proxying keyboard or other events to click is potentially dangerous and thus blocked. Have this simple document (you can copypaste it into URL):
data:text/html,
<input id="f" type="file" onclick="console.log(this,'click')" onfocus="console.log(this,'focus')">
<p>
<button onclick="f.focus()">focus ^</button>
<button onclick="f.click()">click ^</button>
<script style="display:block">
console.log(f);
f.focus();
f.click();
</script>
If you trigger f.click()
by clicking the button, it works. If you trigger it via console, onclick
is fired but not the default action (no file picker is opened). Applies both for Chrome and Firefox. It it wasn't that way, you'd see file picker opened on the page load.
If you try similar experiment at the MDN example after you change the input's type from checkbox
to file
and invoke simulateClick()
from console, you'll get the same outcome (both in Chrome and Firefox).
What seems like a bit of mystery to me is fact that your fiddle works in Chrome, although I'd expect it not to.