Skip to content

Commit b569d1e

Browse files
authored
Rewrite same site checks to same origin (#213)
1 parent bd73be0 commit b569d1e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

storage-access.bs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ To <dfn>determine the initial storage-access eligibility</dfn>, given a [=reques
196196
ISSUE: The concept of "ancestry" is being added to HTML in <a href="https://github.com/whatwg/html/pull/11133">https://github.com/whatwg/html/pull/11133</a>
197197

198198
1. If |request|'s [=request/client=]'s [=environment/has storage access=] is false, return "<code>[=storage access eligibility/ineligible=]</code>".
199-
1. If |request|'s [=url/origin=] is not [=/same site=] with |request|'s [=request/url=]'s [=url/origin=], return "<code>[=storage access eligibility/ineligible=]</code>".
199+
1. If |request|'s [=url/origin=] is not [=/same origin=] with |request|'s [=request/url=]'s [=url/origin=], return "<code>[=storage access eligibility/ineligible=]</code>".
200200
1. Let |allowed| be the result of running [$Should request be allowed to use feature?$] given "<a permission><code>storage-access</code></a>" and |request|.
201201
1. If |allowed| is false, return "<code>[=storage access eligibility/ineligible=]</code>".
202202
1. Return "<code>[=storage access eligibility/eligible=]</code>".
@@ -346,7 +346,7 @@ Insert a new step after step 14 of [=fetch=]:
346346
Insert a new step after step 17 of [=HTTP-redirect fetch=]:
347347

348348
<div algorithm="modified HTTP-redirect fetch">
349-
18. If |request|'s [=request/eligible for storage-access=] is not "<code>[=storage access eligibility/unset=]</code>" and <var ignore>locationURL</var>'s [=url/origin=] is not [=/same site=] with |request|'s [=request/current URL=]'s [=url/origin=], set |request|'s [=request/eligible for storage-access=] to "<code>[=storage access eligibility/ineligible=]</code>".
349+
18. If |request|'s [=request/eligible for storage-access=] is not "<code>[=storage access eligibility/unset=]</code>" and <var ignore>locationURL</var>'s [=url/origin=] is not [=/same origin=] with |request|'s [=request/current URL=]'s [=url/origin=], set |request|'s [=request/eligible for storage-access=] to "<code>[=storage access eligibility/ineligible=]</code>".
350350
</div>
351351

352352
<h3 id="storage">Changes to various client-side storage mechanisms</h3>

0 commit comments

Comments
 (0)