You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>To <dfn id=parse-and-store-response-cookie-headers>parse and store response `<code>Set-Cookie</code>` headers</dfn>,
4290
-
given a <a for=/>request</a><var>request</var> and a <a for=/>response</a><var>response</var>, run these steps:
4301
+
<p>To <dfn id=parse-and-store-response-cookie-headers>parse and store response
4302
+
`<code>Set-Cookie</code>` headers</dfn>, given a <a for=/>request</a><var>request</var> and a <a
4303
+
for=/>response</a><var>response</var>, run these steps:
4304
+
4305
+
<ol>
4306
+
<li><p>If the user-agent is configured to disable cookies for <var>request</var>, it should
4307
+
return.
4308
+
4309
+
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
4310
+
4311
+
<li><p>Let |isSecure| be false.
4312
+
4313
+
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, set
4314
+
|isSecure| to true.
4315
+
4316
+
<li><p>Let |httpOnlyAllowed| be true.
4317
+
4318
+
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
4319
+
4320
+
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=]
4321
+
for |request| is "<code>StrictOrLess</code>", and false otherwise.
4322
+
4323
+
<li><p><a for=list>For each</a><var>header</var> of <var>response</var>'s <a for=response>header
4324
+
list</a>:
4325
+
4291
4326
<ol>
4292
-
<li><p>If the user-agent is configured to disable cookies for <var>request</var>, it should return.
4293
-
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
4294
-
<li><p>Let |isSecure| be false.
4295
-
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
4296
-
<li><p>Let |httpOnlyAllowed| be true.
4297
-
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
4298
-
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=] for |request| is "<code>StrictOrLess</code>", and false otherwise.
4299
-
<li><p><a for=list>For each</a><var>header</var> of <var>response</var>'s <a for=response>header list</a>:
4300
-
<ol>
4301
-
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
|allowNonHostOnlyCookieForPublicSuffix|, and |sameSiteStrictOrLaxAllowed|
4311
4334
</ol>
4335
+
</ol>
4312
4336
</div>
4313
4337
4314
4338
<div algorithm>
4315
-
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a><var>request</var>, run these steps:
4316
-
<ol>
4317
-
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
4318
-
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not null and is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
4319
-
<li><p>If <var>request</var>'s <a for=request>method</a> is "GET" and
4320
-
<var>request</var>'s <a for=request>destination</a> is "document", return "<code>LaxOrLess</code>".
4321
-
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
4322
-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
4323
-
<li><p>Return "StrictOrLess".
4324
-
</ol>
4339
+
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a><var>request</var>,
4340
+
run these steps:
4341
+
4342
+
<ol>
4343
+
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
4344
+
4345
+
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not
4346
+
null and is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>",
4356
+
return "<code>UnsetOrLess</code>".
4357
+
4358
+
<li><p>Return "StrictOrLess".
4359
+
</ol>
4325
4360
</div>
4326
4361
4327
4362
<h2 id=fetching>Fetching</h2>
@@ -6371,7 +6406,9 @@ optional boolean <var>forceNewConnection</var> (default false), run these steps:
6371
6406
<li><p>Set <var>response</var>'s <a for=response>body</a> to a new <a for=/>body</a> whose
6372
6407
<a for=body>stream</a> is <var>stream</var>.
6373
6408
6374
-
<li><p tracking-vector>If <var>includeCredentials</var> is true, the user agent should <a>parse and store response `<code>Set-Cookie</code>` headers</a> given <var>request</var> and <var>response</var>.
6409
+
<li><p tracking-vector>If <var>includeCredentials</var> is true, the user agent should <a>parse and
6410
+
store response `<code>Set-Cookie</code>` headers</a> given <var>request</var> and
0 commit comments