FF90: Adds support for HTTP Sec-Fetch-* headers #5499

hamishwillee · 2021-05-31T07:31:47Z

This updates the documents for Sec-Fetch-* headers as requested in #5375 (for https://bugzilla.mozilla.org/show_bug.cgi?id=1695911)

This depends a bit on BCD to tell me if this should still be considered experimental: BCD

github-actions · 2021-05-31T07:34:07Z

Preview URLs

Flaws

Note! 7 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/HTTP/Headers
Title: HTTP headers
on GitHub
Flaw count: 3

macros:
- /en-US/docs/Glossary/COEP does not exist
- /en-US/docs/Glossary/COOP does not exist
- /en-US/docs/Glossary/CORP does not exist

URL: /en-US/docs/Glossary/Fetch_metadata_request_header
Title: Fetch metadata request header
on GitHub
Flaw count: 1

macros:
- /en-US/docs/Glossary/resource_isolation_policy does not exist

External URLs

URL: /en-US/docs/Web/HTTP/Headers
Title: HTTP headers
on GitHub

No new external URLs

URL: /en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode
Title: Sec-Fetch-Mode
on GitHub

https://secmetadata.appspot.com/ (1 time) (Note! This may be a new URL 👀)
https://web.dev/fetch-metadata/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest
Title: Sec-Fetch-Dest
on GitHub

https://secmetadata.appspot.com/ (1 time) (Note! This may be a new URL 👀)
https://web.dev/fetch-metadata/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/HTTP/Headers/Sec-Fetch-User
Title: Sec-Fetch-User
on GitHub

https://secmetadata.appspot.com/ (1 time) (Note! This may be a new URL 👀)
https://web.dev/fetch-metadata/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site
Title: Sec-Fetch-Site
on GitHub

https://secmetadata.appspot.com/ (1 time) (Note! This may be a new URL 👀)
https://web.dev/fetch-metadata/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/Request/mode
Title: Request.mode
on GitHub

No new external URLs

URL: /en-US/docs/Mozilla/Firefox/Releases/90
Title: Firefox 90 for developers
on GitHub

https://wiki.mozilla.org/RapidRelease/Calendar (1 time) (Note! This may be a new URL 👀)
https://www.mozilla.org/en-US/firefox/channel/desktop/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Glossary/Fetch_metadata_request_header
Title: Fetch metadata request header
on GitHub

https://secmetadata.appspot.com/ (1 time) (Note! This may be a new URL 👀)
https://web.dev/fetch-metadata/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Glossary/HTTP_header
Title: HTTP header
on GitHub

No new external URLs

(this comment was updated 2021-06-04 05:00:13.861751)

hamishwillee · 2021-06-01T06:47:08Z

files/en-us/web/http/headers/index.html

 <dl>
 <dt>{{HTTPHeader("Sec-Fetch-Site")}}</dt>
 <dd>It is a request header that indicates the relationship between a request initiator's origin and its target's origin. It is a Structured Header whose value is a token with possible values <code>cross-site</code>, <code>same-origin</code>, <code>same-site</code>, and <code>none</code>.</dd>
 <dt>{{HTTPHeader("Sec-Fetch-Mode")}}</dt>
- <dd>It is a request header that indicates the request's mode to a server. It is a Structured Header whose value is a token with possible values <code>cors</code>, <code>navigate</code>, <code>nested-navigate</code>, <code>no-cors</code>, <code>same-origin</code>, and <code>websocket</code>.</dd>


Note, nested-navigate and nested-document are not present in the spec

files/en-us/web/http/headers/sec-fetch-dest/index.html

hamishwillee · 2021-06-01T06:49:39Z

files/en-us/glossary/fetch_metadata_request_header/index.html


 <ul>
 <li>{{HTTPHeader("Sec-Fetch-Site")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-Mode")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-User")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-Dest")}}</li>
+ <li><a href="https://web.dev/fetch-metadata/">Protect your resources from web attacks with Fetch Metadata</a> (web.dev)</li> 


This is a good doc on the headers, and how you use them to create a resource isolation policy. It omits the User header. We could do something similar, but link is appropriate IMO for now. I have linked this and the following playground in all the docs.

It seems better to link this (and the one below) after the list of the headers in its own paragraph.

Thanks. Good point. I have handled this by pulling the headers under their own bullet "Related headers". Looks a lot better.

hamishwillee · 2021-06-01T06:54:35Z

This is ready for review. @annevk @Elchi3 You may be interested in providing feedback.

annevk

Thanks! Generally looks good to me.

annevk · 2021-06-01T09:01:10Z

files/en-us/glossary/fetch_metadata_request_header/index.html


 <ul>
 <li>{{HTTPHeader("Sec-Fetch-Site")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-Mode")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-User")}}</li>
 <li>{{HTTPHeader("Sec-Fetch-Dest")}}</li>
+ <li><a href="https://web.dev/fetch-metadata/">Protect your resources from web attacks with Fetch Metadata</a> (web.dev)</li> 


It seems better to link this (and the one below) after the list of the headers in its own paragraph.

files/en-us/glossary/http_header/index.html

files/en-us/web/http/headers/sec-fetch-dest/index.html

files/en-us/web/http/headers/sec-fetch-site/index.html

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

dergoegge

none is not a valid value for sec-fetch-dest

But other than that, this looks good to me.

files/en-us/web/http/headers/sec-fetch-site/index.html

…shwillee/content into ff90_http_sec_fetch_headers

Co-authored-by: Niklas Gögge <n.goeggi@gmail.com>

hamishwillee · 2021-06-04T04:59:14Z

@Rumyra This has been checked by the technical experts, so should be good for your review and merge.

Rumyra

Thanks @hamishwillee - awesome work 👍

hamishwillee added 3 commits May 31, 2021 17:25

Update sec-fetch-site docs

b2196fe

Update Sec-Fetch headers to standard template

6b677f0

update glossary entries for fetch metadata headers

d7fbdd9

hamishwillee mentioned this pull request May 31, 2021

[HTTP] Ship Sec-Fetch-* (Fetch Metadata Request Headers) #5375

Closed

hamishwillee added 10 commits June 1, 2021 12:21

Add websocket as a mode option for Request.mode

80f3da3

Update Sec-Fetch-Mode

269e07a

Further fixes to Sec-Fetch-Site

02adc11

Update Sec-Fetch-user

5b47261

Update Sec-Fetch-Dest

e19ccc1

General consistency updates

9276b25

Bit more context on why these headers are interesting

40e563a

Merge branch 'main' into ff90_http_sec_fetch_headers

d0256c8

Add example to Sec-Fetch-Dest

80c14c4

Add release note

f7cecc8

hamishwillee marked this pull request as ready for review June 1, 2021 06:44

hamishwillee requested review from a team as code owners June 1, 2021 06:44

hamishwillee requested review from Rumyra and removed request for a team June 1, 2021 06:45

hamishwillee commented Jun 1, 2021

View reviewed changes

files/en-us/web/http/headers/sec-fetch-dest/index.html Show resolved Hide resolved

hamishwillee commented Jun 1, 2021

View reviewed changes

annevk mentioned this pull request Jun 1, 2021

Remove outstanding issues w3c/webappsec-fetch-metadata#73

Closed

annevk reviewed Jun 1, 2021

View reviewed changes

Update files/en-us/glossary/http_header/index.html

8e53895

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

dergoegge suggested changes Jun 1, 2021

View reviewed changes

files/en-us/web/http/headers/sec-fetch-site/index.html Outdated Show resolved Hide resolved

files/en-us/web/http/headers/sec-fetch-site/index.html Outdated Show resolved Hide resolved

Better arrange header lists

c57f714

hamishwillee and others added 4 commits June 2, 2021 08:32

Merge branch 'ff90_http_sec_fetch_headers' of https://github.com/hami…

d049680

…shwillee/content into ff90_http_sec_fetch_headers

Update files/en-us/web/http/headers/sec-fetch-site/index.html

0937ab9

Co-authored-by: Niklas Gögge <n.goeggi@gmail.com>

Update files/en-us/web/http/headers/sec-fetch-site/index.html

1ffd654

Co-authored-by: Niklas Gögge <n.goeggi@gmail.com>

Clarify same-site means same scheme for sec-fetch-site

37c09b0

Rumyra approved these changes Jun 4, 2021

View reviewed changes

Rumyra merged commit 5d15b2b into mdn:main Jun 4, 2021

hamishwillee deleted the ff90_http_sec_fetch_headers branch June 7, 2021 01:04

github-actions bot locked as resolved and limited conversation to collaborators Aug 7, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FF90: Adds support for HTTP Sec-Fetch-* headers #5499

FF90: Adds support for HTTP Sec-Fetch-* headers #5499

hamishwillee commented May 31, 2021 •

edited

github-actions bot commented May 31, 2021 •

edited

hamishwillee Jun 1, 2021

hamishwillee Jun 1, 2021

annevk Jun 1, 2021

hamishwillee Jun 1, 2021

hamishwillee commented Jun 1, 2021

annevk left a comment

annevk Jun 1, 2021

dergoegge left a comment

hamishwillee commented Jun 4, 2021

Rumyra left a comment

FF90: Adds support for HTTP Sec-Fetch-* headers #5499

FF90: Adds support for HTTP Sec-Fetch-* headers #5499

Conversation

hamishwillee commented May 31, 2021 • edited

github-actions bot commented May 31, 2021 • edited

Preview URLs

Flaws

External URLs

hamishwillee Jun 1, 2021

Choose a reason for hiding this comment

hamishwillee Jun 1, 2021

Choose a reason for hiding this comment

annevk Jun 1, 2021

Choose a reason for hiding this comment

hamishwillee Jun 1, 2021

Choose a reason for hiding this comment

hamishwillee commented Jun 1, 2021

annevk left a comment

Choose a reason for hiding this comment

annevk Jun 1, 2021

Choose a reason for hiding this comment

dergoegge left a comment

Choose a reason for hiding this comment

hamishwillee commented Jun 4, 2021

Rumyra left a comment

Choose a reason for hiding this comment

hamishwillee commented May 31, 2021 •

edited

github-actions bot commented May 31, 2021 •

edited