@@ -548,6 +548,7 @@ for consistency.
548
548
<p class="note no-backref"> A <a for=/>header list</a> is essentially a
549
549
specialized multimap: an ordered list of key-value pairs with potentially duplicate keys.
550
550
551
+ <div algorithm>
551
552
<p> To
552
553
<dfn export for="header list" id=concept-header-list-get-structured-header>get a structured field value</dfn>
553
554
given a <a for=/>header name</a> <var> name</var> and a string <var> type</var> from a
@@ -574,7 +575,9 @@ given a <a for=/>header name</a> <var>name</var> and a string <var>type</var> fr
574
575
<p class="note"> <a>Get a structured field value</a> intentionally does not distinguish between a
575
576
<a for=/>header</a> not being present and its <a for=header>value</a> failing to parse as a
576
577
<a>structured field value</a> . This ensures uniform processing across the web platform.
578
+ </div>
577
579
580
+ <div algorithm>
578
581
<p> To
579
582
<dfn export for="header list" id=concept-header-list-set-structured-header>set a structured field value</dfn>
580
583
given a <a for=/>tuple</a> (<a for=/>header name</a> <var> name</var> , <a>structured field value</a>
@@ -594,15 +597,19 @@ serialize in interesting and efficient ways. For the moment, Fetch only supports
594
597
<a for=/>header lists</a> only via serialization, and they can be obtained from
595
598
<a for=/>header lists</a> only by parsing. In the future the fact that they are objects might be
596
599
preserved end-to-end. [[!RFC8941]]
600
+ </div>
597
601
598
602
<hr>
599
603
604
+ <div algorithm>
600
605
<p> A <a for=/>header list</a> <var> list</var>
601
606
<dfn export for="header list" lt="contains|does not contain">contains</dfn> a
602
607
<a for=/>header name</a> <var> name</var> if <var> list</var> <a for=list>contains</a> a
603
608
<a for=/>header</a> whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match for
604
609
<var> name</var> .
610
+ </div>
605
611
612
+ <div algorithm>
606
613
<p> To <dfn export for="header list" id=concept-header-list-get>get</dfn> a <a for=/>header name</a>
607
614
<var> name</var> from a <a for=/>header list</a> <var> list</var> , run these steps:
608
615
@@ -614,7 +621,9 @@ preserved end-to-end. [[!RFC8941]]
614
621
whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match for <var> name</var> , separated
615
622
from each other by 0x2C 0x20, in order.
616
623
</ol>
624
+ </div>
617
625
626
+ <div algorithm>
618
627
<p> To
619
628
<dfn export for="header list" lt="get, decode, and split|getting, decoding, and splitting" id=concept-header-list-get-decode-split>get, decode, and split</dfn>
620
629
a <a for=/>header name</a> <var> name</var> from <a for=/>header list</a> <var> list</var> , run these
@@ -629,6 +638,7 @@ steps:
629
638
<li><p> Return the result of <a for="header value">getting, decoding, and splitting</a>
630
639
<var> value</var> .
631
640
</ol>
641
+ </div>
632
642
633
643
<div class=example id=example-header-list-get-decode-split>
634
644
<p> This is how <a for="header list">get, decode, and split</a> functions in practice with
703
713
</table>
704
714
</div>
705
715
716
+ <div algorithm>
706
717
<p> To
707
718
<dfn for="header value" lt="get, decode, and split|getting, decoding, and splitting">get, decode, and split</dfn>
708
719
a <a for=/>header value</a> <var> value</var> , run these steps:
@@ -766,7 +777,9 @@ a <a for=/>header value</a> <var>value</var>, run these steps:
766
777
767
778
<p class=note> Except for blessed call sites, the algorithm directly above is not to be invoked
768
779
directly. Use <a for="header list">get, decode, and split</a> instead.
780
+ </div>
769
781
782
+ <div algorithm>
770
783
<p> To <dfn export for="header list" id=concept-header-list-append>append</dfn> a <a for=/>header</a>
771
784
(<var> name</var> , <var> value</var> ) to a <a for=/>header list</a> <var> list</var> , run these steps:
772
785
@@ -781,12 +794,16 @@ directly. Use <a for="header list">get, decode, and split</a> instead.
781
794
782
795
<li><p> <a for=list>Append</a> (<var> name</var> , <var> value</var> ) to <var> list</var> .
783
796
</ol>
797
+ </div>
784
798
799
+ <div algorithm>
785
800
<p> To <dfn export for="header list" id=concept-header-list-delete>delete</dfn> a
786
801
<a for=/>header name</a> <var> name</var> from a <a for=/>header list</a> <var> list</var> ,
787
802
<a for=list>remove</a> all <a for=/>headers</a> whose <a for=header>name</a> is a
788
803
<a>byte-case-insensitive</a> match for <var> name</var> from <var> list</var> .
804
+ </div>
789
805
806
+ <div algorithm>
790
807
<p> To <dfn export for="header list" id=concept-header-list-set>set</dfn> a <a for=/>header</a>
791
808
(<var> name</var> , <var> value</var> ) in a <a for=/>header list</a> <var> list</var> , run these steps:
792
809
@@ -797,7 +814,9 @@ directly. Use <a for="header list">get, decode, and split</a> instead.
797
814
798
815
<li><p> Otherwise, <a for=list>append</a> (<var> name</var> , <var> value</var> ) to <var> list</var> .
799
816
</ol>
817
+ </div>
800
818
819
+ <div algorithm>
801
820
<p> To <dfn export for="header list" id=concept-header-list-combine>combine</dfn> a
802
821
<a for=/>header</a> (<var> name</var> , <var> value</var> ) in a <a for=/>header list</a>
803
822
<var> list</var> , run these steps:
@@ -812,7 +831,9 @@ directly. Use <a for="header list">get, decode, and split</a> instead.
812
831
813
832
<p class=note> <a for="header list">Combine</a> is used by {{XMLHttpRequest}} and the
814
833
<a spec=websockets lt="establish a WebSocket connection">WebSocket protocol handshake</a> .
834
+ </div>
815
835
836
+ <div algorithm>
816
837
<p> To <dfn>convert header names to a sorted-lowercase set</dfn> , given a <a for=/>list</a> of
817
838
<a lt=name for=header>names</a> <var> headerNames</var> , run these steps:
818
839
@@ -826,7 +847,9 @@ directly. Use <a for="header list">get, decode, and split</a> instead.
826
847
<li><p> Return the result of <a for=set>sorting</a> <var> headerNamesSet</var> in ascending order
827
848
with <a>byte less than</a> .
828
849
</ol>
850
+ </div>
829
851
852
+ <div algorithm>
830
853
<p> To
831
854
<dfn export for="header list" id=concept-header-list-sort-and-combine>sort and combine</dfn>
832
855
a <a for=/>header list</a> <var> list</var> , run these steps:
@@ -853,6 +876,7 @@ a <a for=/>header list</a> <var>list</var>, run these steps:
853
876
854
877
<li><p> Return <var> headers</var> .
855
878
</ol>
879
+ </div>
856
880
857
881
<hr>
858
882
@@ -875,12 +899,15 @@ conditions:
875
899
production as
876
900
<a href=https://github.com/httpwg/http11bis/issues/19 title="fix field-value ABNF">it is broken</a> .
877
901
902
+ <div algorithm>
878
903
<p> To <dfn export for="header value" id=concept-header-value-normalize>normalize</dfn> a
879
904
<a for=/>byte sequence</a> <var> potentialValue</var> , remove any leading and trailing
880
905
<a>HTTP whitespace bytes</a> from <var> potentialValue</var> .
906
+ </div>
881
907
882
908
<hr>
883
909
910
+ <div algorithm>
884
911
<p id=simple-header> To determine whether a <a for=/>header</a> (<var> name</var> , <var> value</var> )
885
912
is a <dfn export>CORS-safelisted request-header</dfn> , run these steps:
886
913
@@ -964,7 +991,9 @@ fetch("https://victim.example/naïve-endpoint", {
964
991
965
992
<p class="note"> There are limited exceptions to the `<code> Content-Type</code> ` header safelist, as
966
993
documented in <a href=#cors-protocol-exceptions>CORS protocol exceptions</a> .
994
+ </div>
967
995
996
+ <div algorithm>
968
997
<p> A <dfn>CORS-unsafe request-header byte</dfn> is a byte <var> byte</var> for which one of the
969
998
following is true:
970
999
@@ -976,7 +1005,9 @@ following is true:
976
1005
<!-- Delimiters from https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6 except for ,/;=
977
1006
and including DEL -->
978
1007
</ul>
1008
+ </div>
979
1009
1010
+ <div algorithm>
980
1011
<p> The <dfn noexport>CORS-unsafe request-header names</dfn> , given a <a for=/>header list</a>
981
1012
<var> headers</var> , are determined as follows:
982
1013
@@ -1006,6 +1037,7 @@ following is true:
1006
1037
<li><p> Return the result of <a>convert header names to a sorted-lowercase set</a> with
1007
1038
<var> unsafeNames</var> .
1008
1039
</ol>
1040
+ </div>
1009
1041
1010
1042
<p> A <dfn export>CORS non-wildcard request-header name</dfn> is a <a for=/>header name</a> that is a
1011
1043
<a>byte-case-insensitive</a> match for `<code> Authorization</code> `.
@@ -1054,6 +1086,7 @@ is a <a>byte-case-insensitive</a> match for one of
1054
1086
<li> `<code> Content-Type</code> `
1055
1087
</ul>
1056
1088
1089
+ <div algorithm>
1057
1090
<p> To determine whether a <a for/>header</a> (<var> name</var> , <var> value</var> ) is a
1058
1091
<dfn noexport>no-CORS-safelisted request-header</dfn> , run these steps:
1059
1092
@@ -1064,7 +1097,9 @@ is a <a>byte-case-insensitive</a> match for one of
1064
1097
<li><p> Return whether (<var> name</var> , <var> value</var> ) is a
1065
1098
<a>CORS-safelisted request-header</a> .
1066
1099
</ol>
1100
+ </div>
1067
1101
1102
+ <div algorithm>
1068
1103
<p id=forbidden-header-name> A <a for=/>header</a> (<var> name</var> , <var> value</var> ) is
1069
1104
<dfn export>forbidden request-header</dfn> if these steps return true:
1070
1105
@@ -1135,6 +1170,7 @@ is a <a>byte-case-insensitive</a> match for one of
1135
1170
handling in the {{Headers}} object. It is forbidden here to avoid leaking this complexity into
1136
1171
requests.
1137
1172
</div>
1173
+ </div>
1138
1174
1139
1175
<p> A <dfn export>forbidden response-header name</dfn> is a <a for=/>header name</a> that is a
1140
1176
<a>byte-case-insensitive</a> match for one of:
@@ -1156,6 +1192,7 @@ is a <a>byte-case-insensitive</a> match for one of
1156
1192
1157
1193
<hr>
1158
1194
1195
+ <div algorithm>
1159
1196
<p> To <dfn export lt="extract header values|extracting header values">extract header values</dfn>
1160
1197
given a <a for=/>header</a> <var> header</var> , run these steps:
1161
1198
@@ -1166,7 +1203,9 @@ given a <a for=/>header</a> <var>header</var>, run these steps:
1166
1203
<li><p> Return one or more <a for=header>values</a> resulting from parsing <var> header</var> 's
1167
1204
<a for=header>value</a> , per the <a>ABNF</a> for <var> header</var> 's <a for=header>name</a> .
1168
1205
</ol>
1206
+ </div>
1169
1207
1208
+ <div algorithm>
1170
1209
<p> To
1171
1210
<dfn export lt="extract header list values|extracting header list values">extract header list values</dfn>
1172
1211
given a <a for=/>header name</a> <var> name</var> and a <a for=/>header list</a> <var> list</var> ,
@@ -1200,7 +1239,9 @@ run these steps:
1200
1239
1201
1240
<li><p> Return <var> values</var> .
1202
1241
</ol>
1242
+ </div>
1203
1243
1244
+ <div algorithm>
1204
1245
<p> To <dfn id=simple-range-header-value>parse a single range header value</dfn> from a
1205
1246
<a>byte sequence</a> <var> value</var> , run these steps:
1206
1247
@@ -1247,6 +1288,7 @@ run these steps:
1247
1288
<p class=note> <a>Parse a single range header value</a> succeeds for a subset of allowed range header
1248
1289
values, but it is the most common form used by user agents when requesting media or resuming
1249
1290
downloads. This format of range header value can be set using <a>add a range header</a> .
1291
+ </div>
1250
1292
1251
1293
<hr>
1252
1294
@@ -2125,6 +2167,7 @@ is to return the result of <a>serializing a request origin</a> with <var>request
2125
2167
2126
2168
<hr>
2127
2169
2170
+ <div algorithm>
2128
2171
<p> To <dfn export for=request id=concept-request-add-range-header>add a range header</dfn> to a
2129
2172
<a for=/>request</a> <var> request</var> , with an integer <var> first</var> , and an optional integer
2130
2173
<var> last</var> , run these steps:
@@ -2152,6 +2195,7 @@ is to return the result of <a>serializing a request origin</a> with <var>request
2152
2195
2153
2196
<p class=note> Features that combine multiple responses into one logical resource are historically a
2154
2197
source of security bugs. Please seek security review for features that deal with partial responses.
2198
+ </div>
2155
2199
2156
2200
<hr>
2157
2201
0 commit comments