diff --git a/fetch.bs b/fetch.bs index b023ee89c..d636a9611 100644 --- a/fetch.bs +++ b/fetch.bs @@ -78,6 +78,14 @@ url:https://tools.ietf.org/html/rfc7234#section-1.2.1;text:delta-seconds;type:df }, "OCSP": { "aliasOf": "RFC2560" + }, + "FEATURE-POLICY": { + "authors": [ + "Ian Clelland" + ], + "href": "https://wicg.github.io/feature-policy/", + "publisher": "WICG", + "title": "Feature Policy" } } @@ -637,6 +645,9 @@ production as

  1. Let value be header's value. +

  2. If header's name starts with a byte-case-insensitive + match to `Sec-`, return true. +

  3. Byte-lowercase header's name and switch on the result: @@ -1295,6 +1306,15 @@ to not have to set request's referrer.

    This can be used to override a referrer policy associated with an environment settings object. +

    A request has an associated +client-hints set, +which is a client-hints set. Unless stated +otherwise, it is the empty set. + +

    This will be used to override a client-hints set associated with +an environment settings object. +[[!CLIENT-HINTS]] +

    A request has an associated synchronous flag. Unless stated otherwise it is unset. @@ -1750,6 +1770,10 @@ initially unset. being provided to an API that didn't make a range request. See the flag's usage for a detailed description of the attack. +

    A response has an associated +image density, which is initially set to +zero. +

    A response can have an associated location URL (null, failure, or a URL). Unless specified otherwise, response has no @@ -2115,6 +2139,18 @@ run these steps:

+

Client-hints set

+ +

A client-hints set is a +set of +Client hint tokens, each +of which is one of `DPR`, `Save-Data`, `Viewport-Width`, +`Width`, `Device-Memory`, `RTT`, `Downlink`, or +`ECT`. + + +`Width`. +

Streams

This section might be integrated into other standards, such as IDL. @@ -3062,6 +3098,10 @@ the request. origin to request's client's origin. +

  • Set request's client-hints set to be a clone + of the client-hints set of the request's + client's global object. +

  • If request's header list does not contain `Accept`, then: @@ -3107,20 +3147,81 @@ the request. HTTP/1 fetches.

  • -

    If request is a subresource request, then: - -

      -

    1. Let record be a new - fetch record consisting of - request and this instance of the - fetch algorithm. - -

    2. Append record to request's - client's - fetch group list of - fetch records. -

    - +

    If request is a navigation request, a user agent should, for each + header name (hintName) in the first column of the + following table, if request's header list + does not contain hintName, then + append + hintName/the value given in the same row on the second column, to + request's header list. + + + + +
    Name + Value +
    `Save-Data` + a suitable save-data value +
    + +

  • + +

    For each hintName of request's + client-hints set: + +

      +
    1. +

      Let value be the first matching statement, switching on hintName: + +

      +
      `DPR` +
      a suitable dpr value +
      `Save-Data` +
      a suitable save-data value +
      `Viewport-Width` +
      a suitable viewport-width value +
      `Width` +
      a suitable width value +
      `Device-Memory` +
      a suitable Device-Memory value +
      `RTT` +
      a suitable RTT value +
      `Downlink` +
      a suitable Downlink value +
      `ECT` +
      a suitable ECT value +
      + +

    2. If request is a subresource request and the result of running Should + request be allowed to use feature?, given request and hintName’s + associated + policy-controlled feature, returns false, then skip the next steps and + continue to the next hintName. + [[!FEATURE-POLICY]] [[!CLIENT-HINTS]] + + + +

    3. Set hintName to "Sec-" concatenated with hintName. + +

    4. If request's header list does not + contain hintName, a user agent should append + hintName/value to request's header list. +

    + +

  • If request is a subresource request, then: +

      +

    1. Let record be a new + fetch record consisting of + request and this instance of the + fetch algorithm. + +

    2. Append record to request's + client's + fetch group list of + fetch records. +

    +

  • If aborted, then: @@ -3494,6 +3595,12 @@ with a CORS flag and recursive flag, run these steps: queue a fetch-request-done task for request. +

  • If request's destination is "image" and response's + header list contains + `Content-DPR`, set response's image density value to the + result of parsing the header value as float. + +

  • Queue a fetch task on request to process response for response. @@ -3857,6 +3964,20 @@ optional CORS flag and CORS-preflight flag, run these steps: not same origin with actualResponse's location URL's origin, then return a network error. +

  • For each hintName of request's + client-hints set: +

      +

    1. Set hintName to "Sec-" concatenated with hintName. +

    2. If request's header list contains + hintName and if the result of running Should + request be allowed to use feature?, given request and hintName’s + associated + policy-controlled feature, returns false, then remove hintName from + header list. + [[!FEATURE-POLICY]] [[!CLIENT-HINTS]] +

    +

  • If CORS flag is set and actualResponse's location URL