Define policy-controlled features

[eeeps]

This PR is part of an attempt to address w3c/webappsec-permissions-policy#129 – using Feature Policy to let authors opt-into sending specific Client Hints to specific origins.

The overall, basic idea is:

1. A new set of policy-controlled features – one for each Client Hint header field – is defined in the Client Hints spec. Those are defined in this PR.
2. A new algorithm which determines whether a request is able to use a policy-controlled feature is defined in the Feature Policy spec.
3. The step in Fetch that appends Client Hint headers calls the new algorithm, checking if a request is allowed to use a Client Hints’ policy-controlled feature before appending the Client Hint header.

[igrigorik]

@eeeps this entire section should live in Feature Policy spec, not here. Could you move it over to your FP PR?

[eeeps]

I'm not sure it belongs in the Feature Policy spec. The Feature Policy spec only defines a generic set of mechanisms, and is not in the business of defining (or even, to date, enumerating) specific policy-controlled features like this.

Can you explain why you don't think these feature policy definitions belong in the Client Hints spec?

Perhaps there's somewhere in the HTML or Fetch specs that'd be a better home?

cc: @yoavweiss

[yoavweiss]

I think you're both right! :)

Cross-origin fetches is a web concept, so it has no place here. At the same time, FP does indeed just define the mechanisms, not the features.

HTML and Fetch are probably the right places for this, where the features are defined in HTML and initialize an object keeping track of the Document's CH delegation to certain third-parties, which is later used in Fetch to actually make a decision on sending the hints themselves using it.

[eeeps]

@yoavweiss do you think this policy-controlled feature definition belongs in (or is blocked by?) whatwg/html#3774, or should I create a new PR on the HTML spec?

[mnot]

If we're going to make the CH spec generic (which still needs to be properly explained/discussed, btw :), I'd think that the CH spec should have a mention of FP and some general guidance, whereas the specific feature definitions / guidance should go wherever those particular hints are defined. YMMV, of course.

[igrigorik]

Fair enough. We could mention FP as an example of how delegation can happen for a browser use case. For other environments.. they may or may not use a similar pattern.

@mnot does that sound reasonable to you?

[martinthomson]

If feature policy were a done deal, that might be OK, but it's still very unstable.

[mnot]

OK, that sounds like an argument for more generic language.

[eeeps]

@yoavweiss is adding these definitions to the HTML spec here: whatwg/html@335f566

@mnot @igrigorik Maybe spin up a separate issue to discuss the level which delegation mechanisms should be explained/exampled in the CH spec?