/
292.txt
141 lines (102 loc) · 6.9 KB
/
292.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
* 仕様書
[REFS[
- [68] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2016-01-21 11:56:00 +09:00]] 版) <https://html.spec.whatwg.org/#concept-module-script-cors-setting>
- [14] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2016-02-16 01:30:20 +09:00]] 版) <https://html.spec.whatwg.org/#the-script-element>
-- [16] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2016-02-21 07:50:23 +09:00]] 版) <https://html.spec.whatwg.org/#attr-script-crossorigin>
-- [21] [CITE@en-GB-x-hixie[HTML Standard]] ([TIME[2016-02-21 07:50:23 +09:00]] 版) <https://html.spec.whatwg.org/#prepare-a-script>
- [24] [CITE@en[Fetch Standard]] ([TIME[2017-06-15 14:00:01 +09:00]]) <https://fetch.spec.whatwg.org/#concept-request-credentials-mode>
- [25] [CITE@en[Fetch Standard]] ([TIME[2017-06-15 14:00:01 +09:00]]) <https://fetch.spec.whatwg.org/#requestcredentials>
]REFS]
* 意味
[17] [CODE(HTMLe)@en[[[script]]]] [[要素]]の [CODE(HTMLa)@en[[[crossorigin]]]]
[[属性]]は、 [[CORS設定群属性]]です [SRC[>>16]]。
[18] [[古典スクリプト]]の場合には、 [CODE(HTMLa)@en[[[crossorigin]]]]
[[属性]]は、他の[[起源]]の[[スクリプト]]の場合に、
[[エラー]]情報を晒すかどうかを制御するものです。 [SRC[>>16]]
[19] [[モジュールスクリプト]]の場合には、 [CODE(HTMLa)@en[[[crossorigin]]]]
[[属性]は、異なる[[起源]]への[[要求]]における [[credentialsモード]]を制御するものです
[SRC[>>16]]。
* 文脈
[15] [CODE(HTMLe)@en[[[script]]]] [[要素]]の種別が[[データブロック]]の時は、
[CODE(HTMLa)@en[[[crossorigin]]]] [[属性]]を使っては[['''なりません''']] [SRC[>>14]]。
* 処理
[28] なお、 [CODE(HTMLe)@en[[[script]]]] [[要素]]では初回処理時の値が使われるので、動的に変更しても、意味を持ちません [SRC[>>16]]。
[22] [[スクリプトの準備]]では、次の通り[[CORS設定]]
([CODE(HTMLa)@en[[[crossorigin]]]] [[内容属性]]の[[状態]])
から定める [[credentialsモード]]が規定されています [SRC[>>21]]。
[FIG(table)[
:state: [[CORS設定]]
:mode: [[credentialsモード]]
:state: [[No CORS]]
:mode: [CODE[[[omit]]]]
:state: [[Anonymous]]
:mode: [CODE[[[same-origin]]]]
:state: [[Use Credentials]]
:mode: [CODE[[[include]]]]
]FIG]
* [CODE(DOMi)@en[HTMLScriptElement]] インターフェイス [CODE(DOMa)@en[crossOrigin]] 属性
[20] [CODE(DOMi)@en[[[HTMLScriptElement]]]] [[インターフェイス]]の
[DFN[[CODE(DOMa)@en[[[cross''O''rigin]]]]]] [[IDL属性]]は、
[CODE(HTMLa)@en[[[crossorigin]]]] [[内容属性]]を[[反映]]しなければ[['''なりません''']]
[SRC[>>14]]。これは[[文字列]]として[[反映]]するものです。
* credentials mode (スクリプト fetch オプション群)
[69] [[スクリプトfetchオプション群]]の[DFN[[F[credentials mode]]]]は、
[[スクリプトのfetch]] で使う [[credentials mode]] です [SRC[>>68]]。
* 歴史
[1] [CITE@en[Web Applications 1.0 r6926 Change crossorigin='' to act like No CORS mode for same-origin resources, at least until a cross-origin redirect comes along.]]
( ([TIME[2012-01-28 11:01:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=6925&to=6926>
[2] [CITE[''''''[''''''whatwg'''''']'''''' Adding crossorigin="" to more elements]]
( ([TIME[2012-11-29 00:50:22 +09:00]] 版))
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-November/038153.html>
[3] [CITE@en[Web Applications 1.0 r7548 Support <script crossorigin>.]]
( ([TIME[2012-11-29 09:23:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=7547&to=7548>
[4] [CITE@en[Web Applications 1.0 r7549 Support <link crossorigin>.]]
( ([TIME[2012-11-29 09:42:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=7548&to=7549>
[5] [CITE@en[Web Applications 1.0 r6142 First draft for working out how to use CORS with <img>, <video>, and <audio>.]]
( ([TIME[2011-05-18 10:09:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=6141&to=6142>
[6] [CITE@en[Web Applications 1.0 r6147 Change cross-origin='' to crossorigin='' since people don't seem to like hyphens. Poor hyphens.]]
( ([TIME[2011-05-24 06:29:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=6146&to=6147>
[7] [CITE@en[Web Applications 1.0 r8727 Make .crossOrigin = null remove the content attribute.]]
( ([TIME[2014-08-29 07:00:00 +09:00]] 版))
<http://html5.org/r/8727>
[8] [CITE@en[Sync with http://html5.org/r/8727 (Make .crossOrigin = null remove the c... · a7c6ed1 · ResponsiveImagesCG/picture-element]]
( ([TIME[2014-09-09 14:04:19 +09:00]] 版))
<https://github.com/ResponsiveImagesCG/picture-element/commit/a7c6ed18e55299c5309060f5ea92d0a2c75febef>
[FIG(quote)[
[FIGCAPTION[
[9] [CITE@en-US[Site Compatibility for Firefox 22 - Mozilla | MDN]]
([TIME[2014-05-03 01:58:20 +09:00]] 版)
<https://developer.mozilla.org/en-US/Firefox/Releases/22/Site_compatibility#HTMLMediaElement.crossorigin_and_HTMLInputElement.inputmode_have_been_renamed>
]FIGCAPTION]
> HTMLMediaElement's crossorigin property has been renamed to crossOrigin,
]FIG]
[10] [CITE@en[Integrate Fetch into HTML · whatwg/html@7c5555a]]
([TIME[2015-09-18 19:12:17 +09:00]] 版)
<https://github.com/whatwg/html/commit/7c5555a16f2920c02244c10756bb2f1a11e87a22>
[11] [CITE@en[Update HTML links and update crossOrigin IDL attribute type. · w3c/svgwg@f55a907]]
([TIME[2016-01-19 10:41:14 +09:00]] 版)
<https://github.com/w3c/svgwg/commit/f55a9071772fd98fada0ae9aad5027b569fb30b8>
[12] [CITE@en[Add <script type="module"> and module resolution/fetching/evaluation · whatwg/html@cd1a9fb]]
([TIME[2016-01-21 22:16:13 +09:00]] 版)
<https://github.com/whatwg/html/commit/cd1a9fb1e83f7d0bc30be8b34ecdaf444a0b19a4>
[13] [CITE@en[Use "credentials mode" instead of "CORS setting" for modules · whatwg/html@7a0ce07]] ([TIME[2016-02-04 17:51:18 +09:00]] 版) <https://github.com/whatwg/html/commit/7a0ce073a8fbade8f44d0e2d4c709ad7cf3ee312>
[23] [CITE@en[Perform 401 processing for "same-origin" scenarios]]
( ([[annevk]]著, [TIME[2016-06-07 20:45:09 +09:00]]))
<https://github.com/whatwg/fetch/commit/7e043ab1324c1144be3f69ff4fbb972781e6511a>
[26] [CITE@en[Vary HTTP cache on credentials mode · Issue #307 · whatwg/fetch]]
([TIME[2017-08-24 16:54:46 +09:00]])
<https://github.com/whatwg/fetch/issues/307>
[27] [CITE@en[Limit crossOrigin reflection to only known values]]
([[ayg]]著, [TIME[2017-08-21 22:07:53 +09:00]])
<https://github.com/whatwg/html/commit/d967dc0120c137d0eb22808d4eaac0726cd8ea78>
[29] [CITE@en[Make integrity="" work on module scripts]]
([[domenic]]著, [TIME[2017-09-14 18:00:24 +09:00]])
<https://github.com/whatwg/html/commit/9275d955dcd604e959cfcc672e0c234b1b8c00db>
[30] [CITE@en[Add <link> rel="modulepreload"]]
([[domenic]]著, [TIME[2017-12-15 05:04:40 +09:00]])
<https://github.com/whatwg/html/commit/7c28027b80208aa6b126fa7b086c44877f584178>