Skip to content

Commit c39e660

Browse files
bvandersloot-mozillabvandersloot-mozilla
committed
incoprorating nits from @annevk 
1 parent 5a05349 commit c39e660

1 file changed

Lines changed: 123 additions & 127 deletions

File tree

‎fetch.bs‎

Lines changed: 123 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,9 @@ urlPrefix:https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-layered-cooki
6464
url:name-serialize-cookies;text:serialize cookies
6565
url:name-garbage-collect-cookies;text:garbage collect cookies
6666

67-
<!-- TODO: pending HTML changes- ancestor enum (https://github.com/whatwg/html/pull/10559), has storage access bit, initiator origin plumbing -->
67+
<!-- TODO: pending HTML changes- ancestor bit (https://github.com/whatwg/html/pull/10559) -->
6868
urlPrefix:https://html.spec.whatwg.org#;type:dfn;spec:html
6969
url:TODO;text:has cross-site ancestor;for:environment
70-
url:TODO;text:has storage access;for:environment
7170
</pre>
7271

7372
<pre class=biblio>
@@ -2259,7 +2258,7 @@ or "<code>object</code>".
22592258

22602259
<li><p>Let <var>lastURL</var> be null.
22612260

2262-
<li><p>Let <var>computedTaint</var> be "<code>same-origin</code>".
2261+
<li><p>Let <var>taint</var> be "<code>same-origin</code>".
22632262

22642263
<li>
22652264
<p><a for=list>For each</a> <var>url</var> of <var>request</var>'s <a for=request>URL list</a>:
@@ -2276,12 +2275,12 @@ or "<code>object</code>".
22762275
<li><p>If <var>url</var>'s <a for=url>origin</a> is not <a>same origin</a> with
22772276
<var>lastURL</var>'s <a for=url>origin</a> and <var>request</var>'s <a for=request>origin</a> is
22782277
not <a>same origin</a> with <var>lastURL</var>'s <a for=url>origin</a>, then set
2279-
<var>computedTaint</var> to "<code>same-site</code>".
2278+
<var>taint</var> to "<code>same-site</code>".
22802279

22812280
<li><p>Set <var>lastURL</var> to <var>url</var>.
22822281
</ol>
22832282

2284-
<li><p>Return <var>computedTaint</var>.
2283+
<li><p>Return <var>taint</var>.
22852284
</ol>
22862285
</div>
22872286

@@ -3324,6 +3323,125 @@ through TLS using ALPN. The protocol cannot be spoofed through HTTP requests in
33243323

33253324
<h2 id=http-extensions>HTTP extensions</h2>
33263325

3326+
<h3 id=cookies>Cookies</h3>
3327+
3328+
<p>The `<code>Cookie</code>` request header and `<code>Set-Cookie</code>` response headers are
3329+
largely defined in their own specifications. We define additional infrastructure to be able to use
3330+
them conveniently here. [[COOKIES]].
3331+
3332+
3333+
<h4 id=cookie-header>`<code>Cookie</code>` header</h4>
3334+
3335+
<div algorithm>
3336+
<p>To <dfn>append a request `<code>Cookie</code>` header</dfn>, given a <a for=/>request</a>
3337+
<var>request</var>:
3338+
3339+
<ol>
3340+
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
3341+
return.
3342+
3343+
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
3344+
3345+
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
3346+
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
3347+
3348+
<li>
3349+
<p>Let |httpOnlyAllowed| be true.
3350+
3351+
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
3352+
<code>document.cookie</code> getter steps for instance.
3353+
3354+
<li>
3355+
<p>Let |cookies| be the result of running <a>retrieve cookies</a> given |isSecure|,
3356+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>, <var>request</var>'s
3357+
<a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|, and |sameSite|.
3358+
3359+
<p class=note>The cookie store returns an ordered list of cookies
3360+
3361+
<li><p>If |cookies| <a for="list">is empty</a>, then return.
3362+
3363+
<li><p>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
3364+
3365+
<li><p><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to
3366+
<var>request</var>'s <a for=request>header list</a>.
3367+
</ol>
3368+
</div>
3369+
3370+
3371+
<h4 id=set-cookie-header>`<code>Set-Cookie</code>` header</h4>
3372+
3373+
<div algorithm>
3374+
<p>To <dfn>parse and store response `<code>Set-Cookie</code>` headers</dfn>, given a
3375+
<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>:
3376+
3377+
<ol>
3378+
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
3379+
return.
3380+
3381+
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
3382+
3383+
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
3384+
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
3385+
3386+
<li>
3387+
<p>Let |httpOnlyAllowed| be true.
3388+
3389+
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
3390+
<code>document.cookie</code> getter steps for instance.
3391+
3392+
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=]
3393+
for |request| is "<code>strict-or-less</code>"; otherwise false.
3394+
3395+
<li>
3396+
<p><a for=list>For each</a> <var>header</var> of <var>response</var>'s
3397+
<a for=response>header list</a>:
3398+
3399+
<ol>
3400+
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match
3401+
for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
3402+
3403+
<li><p><a>Parse and store a cookie</a> given <var>header</var>'s <a for=header>value</a>,
3404+
|isSecure|, <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
3405+
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|,
3406+
|allowNonHostOnlyCookieForPublicSuffix|, and |sameSiteStrictOrLaxAllowed|.
3407+
3408+
<li><p><a>Garbage collect cookies</a> given <var>request</var>'s <a for=request>current URL</a>'s
3409+
<a for=url>host</a>.
3410+
</ol>
3411+
3412+
<p class=note>As noted elsewhere the `<code>Set-Cookie</code>` header cannot be combined and
3413+
therefore each occurrence is processed independently. This is not allowed for any other header.
3414+
</ol>
3415+
</div>
3416+
3417+
3418+
<h4 id=cookie-infrastructure>Cookie infrastructure</h4>
3419+
3420+
<div algorithm>
3421+
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>:
3422+
3423+
<ol>
3424+
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "<code>GET</code>"
3425+
or "<code>POST</code>".
3426+
3427+
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not
3428+
null and is not <a for=/>same site</a> with <var>request</var>'s <a for=request>URL</a>'s
3429+
<a for=url>origin</a>, then return "<code>unset-or-less</code>".
3430+
3431+
<li><p>If <var>request</var>'s <a for=request>method</a> is "<code>GET</code>" and
3432+
<var>request</var>'s <a for=request>destination</a> is "document", then return
3433+
"<code>lax-or-less</code>".
3434+
3435+
<li><p>If <var>request</var>'s <a for=request>client</a>'s
3436+
<a for=environment>has cross-site ancestor</a> is true, then return "<code>unset-or-less</code>".
3437+
3438+
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", then
3439+
return "<code>unset-or-less</code>".
3440+
3441+
<li><p>Return "<code>strict-or-less</code>".
3442+
</ol>
3443+
</div>
3444+
33273445
<h3 id=origin-header>`<code>Origin</code>` header</h3>
33283446

33293447
<p>The `<dfn export http-header id=http-origin><code>Origin</code></dfn>`
@@ -4258,128 +4376,6 @@ indicates the request’s purpose is to fetch a resource that is anticipated to
42584376
prefetch, or to treat it differently when counting page visits.
42594377

42604378

4261-
4262-
<h2 id=cookies>Cookies</h2>
4263-
4264-
<p>The `<code>Cookie</code>` request header and `<code>Set-Cookie</code>` response headers are
4265-
largely defined in their own specifications. We define additional infrastructure to be able to use
4266-
them conveniently here. [[COOKIES]].
4267-
4268-
4269-
<h3 id=cookie-header>`<code>Cookie</code>` header</h3>
4270-
4271-
<div algorithm>
4272-
<p>To <dfn>append a request `<code>Cookie</code>` header</dfn>, given a <a for=/>request</a>
4273-
<var>request</var>:
4274-
4275-
<ol>
4276-
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
4277-
return.
4278-
4279-
<li><p>Let |sameSite| be the result of [=determining the same-site mode=] for <var>request</var>.
4280-
4281-
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
4282-
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
4283-
4284-
<li>
4285-
<p>Let |httpOnlyAllowed| be true.
4286-
4287-
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
4288-
<code>document.cookie</code> getter steps for instance.
4289-
4290-
<li>
4291-
<p>Let |cookies| be the result of running <a>retrieve cookies</a> given |isSecure|,
4292-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>, <var>request</var>'s
4293-
<a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|, and |sameSite|.
4294-
4295-
<p class=note>The cookie store returns an ordered list of cookies
4296-
4297-
<li><p>If |cookies| <a for="list">is empty</a>, then return.
4298-
4299-
<li><p>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
4300-
4301-
<li><p><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to
4302-
<var>request</var>'s <a for=request>header list</a>.
4303-
</ol>
4304-
</div>
4305-
4306-
4307-
<h3 id=set-cookie-header>`<code>Set-Cookie</code>` header</h3>
4308-
4309-
<div algorithm>
4310-
<p>To <dfn>parse and store response `<code>Set-Cookie</code>` headers</dfn>, given a
4311-
<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>:
4312-
4313-
<ol>
4314-
<li><p>If the user agent is configured to disable cookies for <var>request</var>, then it should
4315-
return.
4316-
4317-
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
4318-
4319-
<li><p>Let |isSecure| be true if <var>request</var>'s <a for=request>current URL</a>'s
4320-
<a for=url>scheme</a> is "<code>https</code>"; otherwise false.
4321-
4322-
<li>
4323-
<p>Let |httpOnlyAllowed| be true.
4324-
4325-
<p class=note>True follows from this being invoked from <a>fetch</a>, as opposed to the
4326-
<code>document.cookie</code> getter steps for instance.
4327-
4328-
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=]
4329-
for |request| is "<code>strict-or-less</code>"; otherwise false.
4330-
4331-
<li>
4332-
<p><a for=list>For each</a> <var>header</var> of <var>response</var>'s
4333-
<a for=response>header list</a>:
4334-
4335-
<ol>
4336-
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match
4337-
for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
4338-
4339-
<li><p><a>Parse and store a cookie</a> given <var>header</var>'s <a for=header>value</a>,
4340-
|isSecure|, <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a>,
4341-
<var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a>, |httpOnlyAllowed|,
4342-
|allowNonHostOnlyCookieForPublicSuffix|, and |sameSiteStrictOrLaxAllowed|.
4343-
4344-
<li><p><a>Garbage collect cookies</a> given <var>request</var>'s <a for=request>current URL</a>'s
4345-
<a for=url>host</a>.
4346-
</ol>
4347-
4348-
<p class=note>As noted elsewhere the `<code>Set-Cookie</code>` header cannot be combined and
4349-
therefore each occurrence is processed independently. This is not allowed for any other header.
4350-
</ol>
4351-
</div>
4352-
4353-
4354-
<h3 id=cookie-infrastructure>Cookie infrastructure</h3>
4355-
4356-
<div algorithm>
4357-
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>:
4358-
4359-
<ol>
4360-
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "<code>GET</code>"
4361-
or "<code>POST</code>".
4362-
4363-
<li><p>If <var>request</var>'s <a for=request>top-level navigation initiator origin</a> is not
4364-
null and is not <a for=/>same site</a> with <var>request</var>'s <a for=request>URL</a>'s
4365-
<a for=url>origin</a>, then return "<code>unset-or-less</code>".
4366-
4367-
<li><p>If <var>request</var>'s <a for=request>method</a> is "<code>GET</code>" and
4368-
<var>request</var>'s <a for=request>destination</a> is "document", then return
4369-
"<code>lax-or-less</code>".
4370-
4371-
<li><p>If <var>request</var>'s <a for=request>client</a>'s
4372-
<a for=environment>has cross-site ancestor</a> is true, then return "<code>unset-or-less</code>".
4373-
4374-
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>cross-site</code>", then
4375-
return "<code>unset-or-less</code>".
4376-
4377-
<li><p>Return "<code>strict-or-less</code>".
4378-
</ol>
4379-
</div>
4380-
4381-
4382-
43834379
<h2 id=fetching>Fetching</h2>
43844380

43854381
<p class=note>The algorithm below defines <a lt=fetch for=/>fetching</a>. In broad strokes, it takes

0 commit comments

Comments
 (0)