Skip to content

Commit 853595b

Browse files
bvandersloot-mozillabvandersloot-mozilla
committed
Enum rollup, fix capitalization, and add a cookie section
1 parent c79ead3 commit 853595b

File tree

1 file changed

+81
-87
lines changed

1 file changed

+81
-87
lines changed

‎fetch.bs

Lines changed: 81 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -2249,7 +2249,7 @@ or "<code>object</code>".
22492249

22502250
<div algorithm>
22512251
<p>A <a for=/>request</a> has a <dfn for=request id=concept-request-redirect-taint>redirect-taint</dfn>,
2252-
which is "<code>None</code>", "<code>Cross-Origin</code>", or "<code>Cross-Site</code>".
2252+
which is "<code>same-origin</code>", "<code>same-site</code>", or "<code>cross-site</code>".
22532253
<p>To get <a for=/>request</a> <var>request</var>'s <a>redirect-taint</a>:
22542254

22552255
<ol>
@@ -2258,7 +2258,7 @@ which is "<code>None</code>", "<code>Cross-Origin</code>", or "<code>Cross-Site<
22582258

22592259
<li><p>Let <var>lastURL</var> be null.
22602260

2261-
<li><p>Let <var>crossOriginTaint</var> be "<code>None</code>".
2261+
<li><p>Let <var>computedTaint</var> be "<code>same-origin</code>".
22622262

22632263
<li>
22642264
<p><a for=list>For each</a> <var>url</var> of <var>request</var>'s <a for=request>URL list</a>:
@@ -2269,17 +2269,17 @@ which is "<code>None</code>", "<code>Cross-Origin</code>", or "<code>Cross-Site<
22692269

22702270
<li><p>If <var>url</var>'s <a for=url>origin</a> is not <a for=/>same site</a> with
22712271
<var>lastURL</var>'s <a for=url>origin</a> and <var>request</var>'s <a for=request>origin</a> is
2272-
not <a for=/>same site</a> with <var>lastURL</var>'s <a for=url>origin</a>, then return "<code>Cross-Site</code>".
2272+
not <a for=/>same site</a> with <var>lastURL</var>'s <a for=url>origin</a>, then return "<code>cross-site</code>".
22732273

22742274
<li><p>If <var>url</var>'s <a for=url>origin</a> is not <a>same origin</a> with
22752275
<var>lastURL</var>'s <a for=url>origin</a> and <var>request</var>'s <a for=request>origin</a> is
22762276
not <a>same origin</a> with <var>lastURL</var>'s <a for=url>origin</a>,
2277-
then let <var>crossOriginTaint</var> be "<code>Cross-Origin</code>"..
2277+
then set <var>computedTaint</var> to "<code>same-site</code>".
22782278

22792279
<li>Set <var>lastURL</var> to <var>url</var>.
22802280
</ol>
22812281

2282-
<li>Return <var>crossOriginTaint</var>.
2282+
<li>Return <var>computedTaint</var>.
22832283
</ol>
22842284
</div>
22852285

@@ -2291,7 +2291,7 @@ run these steps:
22912291
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>origin</a> is not
22922292
"<code>client</code>".
22932293

2294-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is not "<code>None</code>",
2294+
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is not "<code>same-origin</code>",
22952295
then return "<code>null</code>".
22962296

22972297
<li><p>Return <var>request</var>'s <a for=request>origin</a>,
@@ -2402,7 +2402,7 @@ source of security bugs. Please seek security review for features that deal with
24022402

24032403
<li><p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
24042404
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> and <var>request</var>'s
2405-
<a for=request>redirect-taint</a> is not "<code>None</code>", then return true.</p>
2405+
<a for=request>redirect-taint</a> is not "<code>same-origin</code>", then return true.</p>
24062406

24072407
<li><p>Return false.</p>
24082408
</ol>
@@ -2515,11 +2515,8 @@ this is also tracked internally using the request's <a for=request>timing allow
25152515
<dfn export for=response>service worker timing info</dfn> (null or a
25162516
<a for=/>service worker timing info</a>), which is initially null.
25172517

2518-
<p>A <a for=/>response</a> has an associated <dfn for=response>has-cross-origin-redirects</dfn>
2519-
(a boolean), which is initially false.
2520-
2521-
<p>A <a for=/>response</a> has an associated <dfn for=response>has-cross-site-redirects</dfn>
2522-
(a boolean), which is initially false.
2518+
<p>A <a for=/>response</a> has an associated <dfn for=response>redirect taint</dfn> ("<code>same-origin</code>",
2519+
"<code>same-site</code>", or "<code>cross-site</code>", which is initially "<code>same-origin</code>".
25232520

25242521
<hr>
25252522

@@ -3324,72 +3321,6 @@ through TLS using ALPN. The protocol cannot be spoofed through HTTP requests in
33243321

33253322
<h2 id=http-extensions>HTTP extensions</h2>
33263323

3327-
<h3 id=cookie-header>`<code>Cookie</code>` header</h3>
3328-
3329-
<p>The `<dfn export http-header id=http-cookie><code>Cookie</code></dfn>`
3330-
request <a for=/>header</a> allows the request to carry locally stored state, such as user credentials.
3331-
3332-
<div algorithm>
3333-
<p>To <dfn id=append-a-request-cookie-header>append a request `<code>Cookie</code>` header</dfn>,
3334-
given a <a for=/>request</a> <var>request</var>:
3335-
<ol>
3336-
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
3337-
<li><p>Let |isSecure| be false.
3338-
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
3339-
<li><p>Let |httpOnlyAllowed| be true.
3340-
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
3341-
<li><p>Let |cookies| be the result of running <a>retrieve cookies</a> given
3342-
|isSecure|,
3343-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
3344-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>,
3345-
|httpOnlyAllowed|, and
3346-
|sameSite|
3347-
3348-
<p class=note>It is expected that the cookie store returns an ordered list of cookies
3349-
<li>If |cookies| <a for="list">is empty</a>, then return.
3350-
<li>Let |value| be the result of <a>serializing cookies</a> given |cookies|.
3351-
<li><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to <var>request</var>'s <a for=request>header list</a>.
3352-
</ol>
3353-
</div>
3354-
3355-
<div algorithm>
3356-
<p>To <dfn id=parse-and-store-response-cookie-headers>parse and store response `<code>Set-Cookie</code>` headers</dfn>,
3357-
given a <a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>, run these steps:
3358-
<ol>
3359-
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
3360-
<li><p>Let |isSecure| be false.
3361-
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
3362-
<li><p>Let |httpOnlyAllowed| be true.
3363-
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
3364-
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=] for |request| is "<code>StrictOrLess</code>", and false otherwise.
3365-
<li><p><a for=list>For each</a> <var>header</var> of <var>response</var>'s <a for=response>header list</a>:
3366-
<ol>
3367-
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
3368-
<li><p><a>Parse and store a cookie</a> given
3369-
<var>header</var>'s <a for=header>value</a>,
3370-
|isSecure|,
3371-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
3372-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>,
3373-
|httpOnlyAllowed|,
3374-
|allowNonHostOnlyCookieForPublicSuffix|, and
3375-
|sameSiteStrictOrLaxAllowed|
3376-
</ol>
3377-
</ol>
3378-
</div>
3379-
3380-
<div algorithm>
3381-
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>, run these steps:
3382-
<ol>
3383-
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
3384-
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not null and is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
3385-
<li><p>If <var>request</var>'s <a for=request>method</a> is "GET" and
3386-
<var>request</var>'s <a for=request>destination</a> is "document", return "<code>LaxOrLess</code>".
3387-
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
3388-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>Cross-Site</code>", return "<code>UnsetOrLess</code>".
3389-
<li><p>Return "StrictOrLess".
3390-
</ol>
3391-
</div>
3392-
33933324
<h3 id=origin-header>`<code>Origin</code>` header</h3>
33943325

33953326
<p>The `<dfn export http-header id=http-origin><code>Origin</code></dfn>`
@@ -4323,7 +4254,75 @@ indicates the request’s purpose is to fetch a resource that is anticipated to
43234254
<p class=note>The server can use this to adjust the caching expiry for prefetches, to disallow the
43244255
prefetch, or to treat it differently when counting page visits.
43254256

4257+
<h2 id=cookies>Cookies</h2>
43264258

4259+
<h3 id=cookie-header>`<code>Cookie</code>` header</h3>
4260+
4261+
<p>The `<code>Cookie</code>` header is largely defined in its own specification. [[COOKIES]].
4262+
We define infrastructure to be able to use conveniently here.
4263+
4264+
<div algorithm>
4265+
<p>To <dfn id=append-a-request-cookie-header>append a request `<code>Cookie</code>` header</dfn>,
4266+
given a <a for=/>request</a> <var>request</var>, run these steps:
4267+
<ol>
4268+
<li><p>If the user-agent is configured to disable cookies for <var>request</var>, it should return.
4269+
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
4270+
<li><p>Let |isSecure| be false.
4271+
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
4272+
<li><p>Let |httpOnlyAllowed| be true.
4273+
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
4274+
<li><p>Let |cookies| be the result of running <a>retrieve cookies</a> given
4275+
|isSecure|,
4276+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
4277+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>,
4278+
|httpOnlyAllowed|, and
4279+
|sameSite|
4280+
4281+
<p class=note>It is expected that the cookie store returns an ordered list of cookies
4282+
<li>If |cookies| <a for="list">is empty</a>, then return.
4283+
<li>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
4284+
<li><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to <var>request</var>'s <a for=request>header list</a>.
4285+
</ol>
4286+
</div>
4287+
4288+
<div algorithm>
4289+
<p>To <dfn id=parse-and-store-response-cookie-headers>parse and store response `<code>Set-Cookie</code>` headers</dfn>,
4290+
given a <a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>, run these steps:
4291+
<ol>
4292+
<li><p>If the user-agent is configured to disable cookies for <var>request</var>, it should return.
4293+
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
4294+
<li><p>Let |isSecure| be false.
4295+
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
4296+
<li><p>Let |httpOnlyAllowed| be true.
4297+
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
4298+
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=] for |request| is "<code>StrictOrLess</code>", and false otherwise.
4299+
<li><p><a for=list>For each</a> <var>header</var> of <var>response</var>'s <a for=response>header list</a>:
4300+
<ol>
4301+
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
4302+
<li><p><a>Parse and store a cookie</a> given
4303+
<var>header</var>'s <a for=header>value</a>,
4304+
|isSecure|,
4305+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
4306+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>,
4307+
|httpOnlyAllowed|,
4308+
|allowNonHostOnlyCookieForPublicSuffix|, and
4309+
|sameSiteStrictOrLaxAllowed|
4310+
</ol>
4311+
</ol>
4312+
</div>
4313+
4314+
<div algorithm>
4315+
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>, run these steps:
4316+
<ol>
4317+
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
4318+
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not null and is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
4319+
<li><p>If <var>request</var>'s <a for=request>method</a> is "GET" and
4320+
<var>request</var>'s <a for=request>destination</a> is "document", return "<code>LaxOrLess</code>".
4321+
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
4322+
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
4323+
<li><p>Return "StrictOrLess".
4324+
</ol>
4325+
</div>
43274326

43284327
<h2 id=fetching>Fetching</h2>
43294328

@@ -4778,11 +4777,8 @@ steps:
47784777
<!-- If you are ever tempted to move this around, carefully consider responses from about URLs,
47794778
blob URLs, service workers, HTTP cache, HTTP network, etc. -->
47804779

4781-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is not "<code>None</code>", then set
4782-
<var>internalResponse</var>'s <a for=response>has-cross-origin-redirects</a> to true.
4783-
4784-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>Cross-Site</code>", then set
4785-
<var>internalResponse</var>'s <a for=response>has-cross-site-redirects</a> to true.
4780+
<li><p>Set <var>internalResponse</var>'s <a for=response>redirect taint</a> to <var>request</var>'s
4781+
<a for=request>redirect-taint</a>.
47864782

47874783
<li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is unset, then set
47884784
<var>internalResponse</var>'s <a for=response>timing allow passed flag</a>.
@@ -4935,7 +4931,7 @@ steps:
49354931
<li>
49364932
<p>If <var>fetchParams</var>'s <a for="fetch params">request</a>'s <a for=request>mode</a> is
49374933
not "<code>navigate</code>" or <var>response</var>'s
4938-
<a for=response>has-cross-origin-redirects</a> is false:
4934+
<a for=response>redirect taint</a> is "<code>same-origin</code>":
49394935

49404936
<ol>
49414937
<li><p>Set <var>responseStatus</var> to <var>response</var>'s <a for=response>status</a>.
@@ -5811,9 +5807,7 @@ run these steps:
58115807
<p>If <var>includeCredentials</var> is true, then:
58125808

58135809
<ol>
5814-
<p class=note>This permits some implementations to choose to not support cookies for some or all <var>httpRequest</var>s.
5815-
5816-
<li><p>The user agent should <a>append a request `<code>Cookie</code>` header</a> for <var>httpRequest</var>.
5810+
<li><p><a>Append a request `<code>Cookie</code>` header</a> for <var>httpRequest</var>.
58175811

58185812
<li>
58195813
<p>If <var>httpRequest</var>'s <a for=request>header list</a>

0 commit comments

Comments
 (0)