Skip to content

Add Accept-CH-lifetime cache and CH header handling #729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yoavweiss wants to merge 1 commit into from
Closed

Add Accept-CH-lifetime cache and CH header handling #729

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 53 additions & 1 deletion fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1744,7 +1744,6 @@ run these steps:
<li><p>Return <b>allowed</b>.
</ol>


<h3 id=client-hints-list>Client hints list</h3>

<p class=note>This section will be integrated into HTTP Client Hints.
Expand All @@ -1758,6 +1757,46 @@ of which is one of `<code>DPR</code>`, `<code>Save-Data</code>`, `<code>Viewport
`<code>Width</code>`.


<h3 id=accept-ch-cache>Accept-CH cache</h3>

<p>An <dfn id=concept-accept-ch-cache>Accept-CH cache</dfn> is owned by the user agent and consists
of a collection of entries where each entry has these fields:

<ul class=brief>
<li><dfn id=concept-accept-ch-cache-origin for=accept-ch-cache>origin</dfn> (an <a for=/>origin</a>)
<li><dfn id=concept-accept-ch-cache-max-age for=accept-ch-cache>max-age</dfn> (a number of seconds)
<li><dfn id=concept-accept-ch-cache-client-hints-list for=accept-ch-cache>client-hints list</dfn>
</ul>

<p>Entries must be removed after the seconds specified in the
Copy link
Member

@igrigorik igrigorik May 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need any extra clauses to ensure that this cache is purged when user clears site-data or similar?

Copy link
Collaborator Author

@yoavweiss yoavweiss May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably

Copy link
Collaborator Author

@yoavweiss yoavweiss May 28, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mikewest what's the best way to hook this to clear-site-data and similar UI concepts (e.g. user cleared their cookies)? Looking at https://w3c.github.io/webappsec-clear-site-data/#clear-dom it seems to enumerate all the relevant things that need to be cleared? Should the ACHL cache do the same?

<a for=accept-ch-cache>max-age</a> field have passed since storing the entry.
Entries may be removed before that moment arrives.

<p>To <dfn id=concept-accept-ch-cache-create-entry for=accept-ch-cache>create a new entry</dfn> in
the <a>Accept-CH cache</a>, given <var>origin</var>, <var>max-age</var>, and
<var>client-hints list</var>, do so as follows:

<dl>
<dt><a for=accept-ch-cache>origin</a>
<dd><var>origin</var>

<dt><a for=accept-ch-cache>max-age</a>
<dd><var>max-age</var>

<dt><a for=accept-ch-cache>client-hints list</a>
<dd><var>client-hints list</var>
</dl>

<p>To <dfn export id=concept-retrieve-client-hints-list-accept-ch-cache>retrieve client-hints list</dfn>,
given an <var>origin</var>:
<ol>
<li>Let <var>client-hints list</var> be an empty list.
<li>Fetch any entries from <a>Accept-CH cache</a> which <a for=accept-ch-cache>origin</a> is
identical to <var>origin</var>.
<li>For each entry, for each token in its <a for=accept-ch-cache>client-hints list</a>,
if the token is not in <var>client-hints list</var>, add it.
<li>Return <var>client-hints list</var>.

<h3 id=streams>Streams</h3>

<p class="note no-backref">This section might be integrated into other standards, such as IDL.
Expand Down Expand Up @@ -2897,6 +2936,19 @@ with a <i>CORS flag</i> and <i>recursive flag</i>, run these steps:
<li><p><a href=https://w3c.github.io/webappsec-csp/#set-response-csp-list>Set <var>internalResponse</var>'s CSP list</a>.
[[!CSP]]

<li><p>If <var>response</var>'s
<a href=http://httpwg.org/http-extensions/client-hints.html#accept-ch>Accept-CH header</a>
is present, process the header and add its client-hints tokens to the <a>active document</a>'s
Copy link
Member

@igrigorik igrigorik May 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restrict to HTTPS only?

Copy link
Collaborator Author

@yoavweiss yoavweiss May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah

client-hints list.

<!--TODO: define the active document's client hints list -->

<li><p>If <var>response</var>'s
<a href=http://httpwg.org/http-extensions/client-hints.html#accept-ch-lifetime>Accept-CH-Lifetime header</a>
is present, call
<a for=accept-ch-cache>create a new entry</a> with <var>response</var>'s <var>origin</var>, the
Copy link
Member

@igrigorik igrigorik May 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto, https-only?

parsed <var>max-age</var>, and the <a>active document</a>'s client-hints list.

<li>
<p>If <var>response</var> is not a <a>network error</a> and any
of the following algorithms returns <b>blocked</b>, then set <var>response</var> and
Expand Down