Skip to content

Commit 951fee0

Browse files
bvandersloot-mozillaannevk
bvandersloot-mozilla
authored and
annevk
committed
incoprorating nits from @annevk 
1 parent f1f4c66 commit 951fee0

File tree

1 file changed

+123
-127
lines changed

1 file changed

+123
-127
lines changed

‎fetch.bs

Lines changed: 123 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,9 @@ urlPrefix:https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-layered-cooki
6464
url:name-serialize-cookies;text:serialize cookies
6565
url:name-garbage-collect-cookies;text:garbage collect cookies
6666

67-
<!-- TODO: pending HTML changes- ancestor enum (https://github.com/whatwg/html/pull/10559), has storage access bit, initiator origin plumbing -->
67+
<!-- TODO: pending HTML changes- ancestor bit (https://github.com/whatwg/html/pull/10559) -->
6868
urlPrefix:https://html.spec.whatwg.org#;type:dfn;spec:html
6969
url:TODO;text:has cross-site ancestor;for:environment
70-
url:TODO;text:has storage access;for:environment
7170
</pre>
7271

7372
<pre class=biblio>
@@ -2282,7 +2281,7 @@ or "<code>object</code>".
22822281

22832282
<li><p>Let <var>lastURL</var> be null.
22842283

2285-
<li><p>Let <var>computedTaint</var> be "<code>same-origin</code>".
2284+
<li><p>Let <var>taint</var> be "<code>same-origin</code>".
22862285

22872286
<li>
22882287
<p><a for=list>For each</a> <var>url</var> of <var>request</var>'s <a for=request>URL list</a>:
@@ -2299,12 +2298,12 @@ or "<code>object</code>".
22992298
<li><p>If <var>url</var>'s <a for=url>origin</a> is not <a>same origin</a> with
23002299
<var>lastURL</var>'s <a for=url>origin</a> and <var>request</var>'s <a for=request>origin</a> is
23012300
not <a>same origin</a> with <var>lastURL</var>'s <a for=url>origin</a>, then set
2302-
<var>computedTaint</var> to "<code>same-site</code>".
2301+
<var>taint</var> to "<code>same-site</code>".
23032302

23042303
<li><p>Set <var>lastURL</var> to <var>url</var>.
23052304
</ol>
23062305

2307-
<li><p>Return <var>computedTaint</var>.
2306+
<li><p>Return <var>taint</var>.
23082307
</ol>
23092308
</div>
23102309

@@ -3347,6 +3346,125 @@ through TLS using ALPN. The protocol cannot be spoofed through HTTP requests in
33473346

33483347
<h2 id=http-extensions>HTTP extensions</h2>
33493348

3349+
<h3 id=cookies>Cookies</h3>
3350+
3351+
<p>The `<code>Cookie</code>` request header and `<code>Set-Cookie</code>` response headers are
3352+
largely defined in their own specifications. We define additional infrastructure to be able to use
3353+
them conveniently here. [[COOKIES]].
3354+
3355+
3356+
<h4 id=cookie-header>`<code>Cookie</code>` header</h4>
3357+
3358+
<div algorithm>
3359+
<p>To <dfn>append a request `<code>Cookie</code>` header</dfn>, given a <a for=/>request</a>
3360+
<var>request</var>:
3361+
3362+
<ol>
3363+
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
3364+
return.
3365+
3366+
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
3367+
3368+
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
3369+
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
3370+
3371+
<li>
3372+
<p>Let |httpOnlyAllowed| be true.
3373+
3374+
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
3375+
<code>document.cookie</code> getter steps for instance.
3376+
3377+
<li>
3378+
<p>Let |cookies| be the result of running <a>retrieve cookies</a> given |isSecure|,
3379+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>, <var>request</var>'s
3380+
<a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|, and |sameSite|.
3381+
3382+
<p class=note>The cookie store returns an ordered list of cookies
3383+
3384+
<li><p>If |cookies| <a for="list">is empty</a>, then return.
3385+
3386+
<li><p>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
3387+
3388+
<li><p><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to
3389+
<var>request</var>'s <a for=request>header list</a>.
3390+
</ol>
3391+
</div>
3392+
3393+
3394+
<h4 id=set-cookie-header>`<code>Set-Cookie</code>` header</h4>
3395+
3396+
<div algorithm>
3397+
<p>To <dfn>parse and store response `<code>Set-Cookie</code>` headers</dfn>, given a
3398+
<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>:
3399+
3400+
<ol>
3401+
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
3402+
return.
3403+
3404+
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
3405+
3406+
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
3407+
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
3408+
3409+
<li>
3410+
<p>Let |httpOnlyAllowed| be true.
3411+
3412+
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
3413+
<code>document.cookie</code> getter steps for instance.
3414+
3415+
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=]
3416+
for |request| is "<code>strict-or-less</code>"; otherwise false.
3417+
3418+
<li>
3419+
<p><a for=list>For each</a> <var>header</var> of <var>response</var>'s
3420+
<a for=response>header list</a>:
3421+
3422+
<ol>
3423+
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match
3424+
for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
3425+
3426+
<li><p><a>Parse and store a cookie</a> given <var>header</var>'s <a for=header>value</a>,
3427+
|isSecure|, <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
3428+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|,
3429+
|allowNonHostOnlyCookieForPublicSuffix|, and |sameSiteStrictOrLaxAllowed|.
3430+
3431+
<li><p><a>Garbage collect cookies</a> given <var>request</var>'s <a for=request>current URL</a>'s
3432+
<a for=url>host</a>.
3433+
</ol>
3434+
3435+
<p class=note>As noted elsewhere the `<code>Set-Cookie</code>` header cannot be combined and
3436+
therefore each occurrence is processed independently. This is not allowed for any other header.
3437+
</ol>
3438+
</div>
3439+
3440+
3441+
<h4 id=cookie-infrastructure>Cookie infrastructure</h4>
3442+
3443+
<div algorithm>
3444+
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>:
3445+
3446+
<ol>
3447+
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "<code>GET</code>"
3448+
or "<code>POST</code>".
3449+
3450+
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not
3451+
null and is not <a for=/>same site</a> with <var>request</var>'s <a for=request>URL</a>'s
3452+
<a for=url>origin</a>, then return "<code>unset-or-less</code>".
3453+
3454+
<li><p>If <var>request</var>'s <a for=request>method</a> is "<code>GET</code>" and
3455+
<var>request</var>'s <a for=request>destination</a> is "document", then return
3456+
"<code>lax-or-less</code>".
3457+
3458+
<li><p>If <var>request</var>'s <a for=request>client</a>'s
3459+
<a for=environment>has cross-site ancestor</a> is true, then return "<code>unset-or-less</code>".
3460+
3461+
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", then
3462+
return "<code>unset-or-less</code>".
3463+
3464+
<li><p>Return "<code>strict-or-less</code>".
3465+
</ol>
3466+
</div>
3467+
33503468
<h3 id=origin-header>`<code>Origin</code>` header</h3>
33513469

33523470
<p>The `<dfn export http-header id=http-origin><code>Origin</code></dfn>`
@@ -4283,128 +4401,6 @@ indicates the request’s purpose is to fetch a resource that is anticipated to
42834401
prefetch, or to treat it differently when counting page visits.
42844402

42854403

4286-
4287-
<h2 id=cookies>Cookies</h2>
4288-
4289-
<p>The `<code>Cookie</code>` request header and `<code>Set-Cookie</code>` response headers are
4290-
largely defined in their own specifications. We define additional infrastructure to be able to use
4291-
them conveniently here. [[COOKIES]].
4292-
4293-
4294-
<h3 id=cookie-header>`<code>Cookie</code>` header</h3>
4295-
4296-
<div algorithm>
4297-
<p>To <dfn>append a request `<code>Cookie</code>` header</dfn>, given a <a for=/>request</a>
4298-
<var>request</var>:
4299-
4300-
<ol>
4301-
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
4302-
return.
4303-
4304-
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
4305-
4306-
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
4307-
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
4308-
4309-
<li>
4310-
<p>Let |httpOnlyAllowed| be true.
4311-
4312-
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
4313-
<code>document.cookie</code> getter steps for instance.
4314-
4315-
<li>
4316-
<p>Let |cookies| be the result of running <a>retrieve cookies</a> given |isSecure|,
4317-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>, <var>request</var>'s
4318-
<a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|, and |sameSite|.
4319-
4320-
<p class=note>The cookie store returns an ordered list of cookies
4321-
4322-
<li><p>If |cookies| <a for="list">is empty</a>, then return.
4323-
4324-
<li><p>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
4325-
4326-
<li><p><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to
4327-
<var>request</var>'s <a for=request>header list</a>.
4328-
</ol>
4329-
</div>
4330-
4331-
4332-
<h3 id=set-cookie-header>`<code>Set-Cookie</code>` header</h3>
4333-
4334-
<div algorithm>
4335-
<p>To <dfn>parse and store response `<code>Set-Cookie</code>` headers</dfn>, given a
4336-
<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>:
4337-
4338-
<ol>
4339-
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
4340-
return.
4341-
4342-
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
4343-
4344-
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
4345-
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
4346-
4347-
<li>
4348-
<p>Let |httpOnlyAllowed| be true.
4349-
4350-
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
4351-
<code>document.cookie</code> getter steps for instance.
4352-
4353-
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=]
4354-
for |request| is "<code>strict-or-less</code>"; otherwise false.
4355-
4356-
<li>
4357-
<p><a for=list>For each</a> <var>header</var> of <var>response</var>'s
4358-
<a for=response>header list</a>:
4359-
4360-
<ol>
4361-
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match
4362-
for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
4363-
4364-
<li><p><a>Parse and store a cookie</a> given <var>header</var>'s <a for=header>value</a>,
4365-
|isSecure|, <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
4366-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|,
4367-
|allowNonHostOnlyCookieForPublicSuffix|, and |sameSiteStrictOrLaxAllowed|.
4368-
4369-
<li><p><a>Garbage collect cookies</a> given <var>request</var>'s <a for=request>current URL</a>'s
4370-
<a for=url>host</a>.
4371-
</ol>
4372-
4373-
<p class=note>As noted elsewhere the `<code>Set-Cookie</code>` header cannot be combined and
4374-
therefore each occurrence is processed independently. This is not allowed for any other header.
4375-
</ol>
4376-
</div>
4377-
4378-
4379-
<h3 id=cookie-infrastructure>Cookie infrastructure</h3>
4380-
4381-
<div algorithm>
4382-
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>:
4383-
4384-
<ol>
4385-
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "<code>GET</code>"
4386-
or "<code>POST</code>".
4387-
4388-
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not
4389-
null and is not <a for=/>same site</a> with <var>request</var>'s <a for=request>URL</a>'s
4390-
<a for=url>origin</a>, then return "<code>unset-or-less</code>".
4391-
4392-
<li><p>If <var>request</var>'s <a for=request>method</a> is "<code>GET</code>" and
4393-
<var>request</var>'s <a for=request>destination</a> is "document", then return
4394-
"<code>lax-or-less</code>".
4395-
4396-
<li><p>If <var>request</var>'s <a for=request>client</a>'s
4397-
<a for=environment>has cross-site ancestor</a> is true, then return "<code>unset-or-less</code>".
4398-
4399-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", then
4400-
return "<code>unset-or-less</code>".
4401-
4402-
<li><p>Return "<code>strict-or-less</code>".
4403-
</ol>
4404-
</div>
4405-
4406-
4407-
44084404
<h2 id=fetching>Fetching</h2>
44094405

44104406
<p class=note>The algorithm below defines <a lt=fetch for=/>fetching</a>. In broad strokes, it takes

0 commit comments

Comments
 (0)