You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
context</a> has no <adata-link-type="dfn">parent browsing context</a>.
1043
+
context</a> has no <adata-link-type="dfn"href="http://www.w3.org/TR/html5/browsers.html#parent-browsing-context">parent browsing context</a>.
1044
1044
1045
1045
1046
-
<pclass="issue" id="issue-cb07f5b7"><aclass="self-link" href="#issue-cb07f5b7"></a> Is this right, Anne?</p>
1046
+
<pclass="issue" id="issue-58787eb8"><aclass="self-link" href="#issue-58787eb8"></a> This doesn’t yet work correctly for content inside an
1047
+
<code><adata-link-type="element" href="http://www.w3.org/TR/html5/embedded-content-0.html#the-iframe-element">iframe</a></code> or <code><adata-link-type="element" href="http://www.w3.org/TR/html5/obsolete.html#frame">frame</a></code>.</p>
1047
1048
1048
1049
1049
1050
@@ -1080,26 +1081,8 @@ <h3 class="heading settled" data-level="5.3" id="should-block-fetch"><span class
1080
1081
1081
1082
<li>
1082
1083
<var>request</var>’s <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-initiator">initiator</a> is "<code>fetch</code>", and
1083
-
<adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-destination">destination</a> is "<code>subresource</code>", and either of the
1084
-
following conditions are met:
1085
-
1086
-
1087
-
<ol>
1088
-
1089
-
<li>
1090
-
<var>request</var> is <em>not</em> a <adata-link-type="dfn" href="#passthrough-request">passthrough
1091
-
request</a>.
1092
-
1093
-
1094
-
1095
-
<li>
1096
-
If <var>request</var>’s <code>mode</code> is not
1097
-
<code>no-cors</code>.
1098
-
1099
-
1100
-
1101
-
</ol>
1102
-
1084
+
<adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-destination">destination</a> is "<code>subresource</code>", and
1085
+
<var>request</var> is <em>not</em> a <adata-link-type="dfn" href="#passthrough-request">passthrough request</a>.
If <ahref="#categorize-settings-object">§5.1 Does settings object restrict mixed content?</a> returns <code>Does Not Restrict
1200
-
Mixed Content</code> when applied to <var>request</var>’s <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client">client</a>,
1201
-
return <strong>allowed</strong>.
1202
-
1203
-
1204
-
1205
-
<li>
1206
-
If the user agent has been instructed to allow <adata-link-type="dfn" href="#mixed-content">mixed content</a>
1207
-
(as outlined in <ahref="#requirements-user-controls">§7.4 User Controls</a>), return
1208
-
<strong>allowed</strong>.
1182
+
Return <strong>allowed</strong> if one or more of the following
1183
+
conditions are met:
1184
+
1185
+
1186
+
<ol>
1187
+
1188
+
<li>
1189
+
<ahref="#categorize-settings-object">§5.1 Does settings object restrict mixed content?</a> returns <code>Does Not Restrict
1190
+
Mixed Content</code> when applied to <var>request</var>’s
context</a> has no <adata-link-type="dfn" href="http://www.w3.org/TR/html5/browsers.html#parent-browsing-context">parent browsing context</a>.
1211
+
1212
+
1213
+
<pclass="issue" id="issue-58787eb80"><aclass="self-link" href="#issue-58787eb80"></a> This doesn’t yet work correctly for content inside an
1214
+
<code><adata-link-type="element" href="http://www.w3.org/TR/html5/embedded-content-0.html#the-iframe-element">iframe</a></code> or <code><adata-link-type="element" href="http://www.w3.org/TR/html5/obsolete.html#frame">frame</a></code>.</p>
1215
+
1216
+
1217
+
1218
+
1219
+
</ol>
1220
+
1209
1221
1210
1222
1211
1223
1212
1224
<li>
1213
-
Let <var>context</var> be the <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-context">request context</a> of
1214
-
<var>request</var>.
1225
+
Return <strong>blocked</strong> if one or more of the following
1226
+
conditions are met:
1227
+
1228
+
1229
+
<ol>
1230
+
1231
+
<li>
1232
+
The user agent is configured to block <adata-link-type="dfn" href="#optionally_blockable">optionally-blockable</a>
1233
+
mixed content, as described in <ahref="#requirements-user-controls">§7.4 User Controls</a>.
If <var>response</var>’s <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response-https-state">HTTPS state</a> is not
1220
-
<code>authenticated</code>:
1249
+
Return <strong>allowed</strong> if <var>response</var> is an <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-filtered-response-opaque">opaque
1250
+
filtered response</a> and one or more of the following conditions are
1251
+
met:
1221
1252
1222
1253
1223
1254
<ol>
1224
1255
1225
1256
<li>
1226
-
If <var>context</var> is <code>fetch</code>:
1227
-
1228
-
1229
-
<ol>
1230
-
1231
-
<li>
1232
-
If <var>request</var> is <strong>not</strong> a <adata-link-type="dfn" href="#passthrough-request">passthrough
1233
-
request</a>, return <strong>blocked</strong>.
1234
-
1235
-
1236
-
1237
-
<li>
1238
-
If <var>response</var> is <strong>not</strong> an <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-filtered-response-opaque">opaque
<p><ahref="#should-block-fetch">§5.3 Should fetching request be blocked as mixed content?</a> has some carve-outs for the <code>fetch</code>
1572
-
request context, with the intent of allowing a Service Worker to copy
1573
-
a request as part of its response to a Fetch event (e.g.
1550
+
request <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-initiator">initiator</a>, with the intent of allowing a Service Worker
1551
+
to copy a request as part of its response to a Fetch event (e.g.
1574
1552
<code>fetch(event.response)</code> should be executable inside the
1575
1553
event handler.</p>
1576
1554
1577
1555
1578
1556
1579
-
<p>The <code>fetch</code>request context will continue to be treated as
1580
-
<adata-link-type="dfn" href="#blockable">blockable</a> when executed outside the context of a Fetch event,
1581
-
which of course includes document contexts.</p>
1557
+
<p><code>fetch</code> will continue to be treated as<adata-link-type="dfn" href="#blockable">blockable</a> when
1558
+
executed outside the context of a Fetch event, which of course includes
0 commit comments