521.txt

* プロトコル

[48] [[Fetch]] は次の[[プロトコル]]や[[アルゴリズム]]と深く関係しています。
[FIG(short list)[
- [[HTTP]]
-- [[HTTPキャッシュ]]
-- [[HTTP認証]]
-- [[HTTP CORS Protocol]]
-- [[HTTPリダイレクト]]
-- [[HSTS]]
-- [[HTTPクッキー]]
-- [[HTTPS]]
-- [[service identity]]
-- [CODE(HTTP)@en[[[HTTPS:]]]]
- [[FTP]]
- [CODE(DOMi)@en[[[Blob]]]]
- [CODE(URI)@en[[[data:]]]]
- [[CSP]]
- [[Referrer Policy]]
- [[port blocking]]
- [[Service Worker]]
- [[MIME Sniffing]]
- [[navigate]]
- [[イベントループ]]
]FIG]

;; [62] [[Web Socket]] は [[fetch]] とは別に実装されています。

* 読み込みタイミング

[47] [[HTML]] における [[fetch]] とその後の処理の実施タイミングについては、
次の機能が存在または提案されています。
[FIG(short list)[
- [CODE(HTMLa)@en[[[defer]]]]
- [CODE(HTMLa)@en[[[async]]]]
- [CODE(HTML)@en[[[rel=dns-prefetch]]]]
- [CODE(HTML)@en[[[rel=prefetch]]]]
- [CODE(HTML)@en[[[rel=preload]]]]
- [CODE(HTML)@en[[[rel=prerender]]]]
- [[HTML Imports]]
- [CODE(HTMLa)@en[[[lazyload]]]]
- [CODE(HTMLa)@en[[[dependson]]]]
- [CODE(HTMLa)@en[[[loadpolicy]]]]
]FIG]

* 歴史

** fetch の明文化

[53] 仕様上の[[アルゴリズム]]としての [[fetch]] は、2008年8月に [[HTML5]]
(現 [[HTML Standard]]) で定義されました [SRC[>>57]]。

;; [55] それまで [[HTML5]] は各[[要素]]や [[API]]、[[navigate]] の挙動の規定で[[一般動詞]]
[[fetch]] を使っており、挙動を明確化する必要があるとの [[TODO]]
が記載はされていましたが、仕様上の用語としてはこの時追加されました。

[54] 実装上 [[fetch]] に相当するものは [[navigate]] の一部としては [[WWW]]
の誕生以来、[[ページ]]の[[レンダリング]]の一部としては1994年の [CODE(HTMLe)@en[[[img]]]]
[[要素]]の追加以来ずっと存在していましたが、 ([[Webブラウザー]]の[[ソースコード]]以外で)
明確に文書化されたのはこれが初めてでした。

[56] この時期は[[HTMLの構文解析器]]や既存の[[HTML要素]]、[[navigate]] や [[AppCache]]
が [[HTML5]] で規定された後で、[[イベントループ]]や [[WF2]] の統合よりは前に当たります。
それまで明確に文書化されてこなかった [[HTML]] の諸[[要素]]・[[API]]
の挙動を定義していく中での流れでした。 [[fetch]] が定義された後間もなく[[イベントループ]]が定義され、
[[fetch]] との関係も規定されています [SRC[>>52]]。

[59] とはいえこの当時の [[fetch]] は非常に単純で、 [[URL]] を[[解決]]してから
[[HTTP]] の規定に従う、といった程度の内容でした。 [[Webブラウザー]]の挙動を記述するには、
更なる詳細化が必要でした。

[REFS[
- [57] [CITE@en[Web Applications 1.0 r1971 Define fetching. (bug 5848)]]
([TIME[2008-08-02 18:23:00 +09:00]] 版)
<https://html5.org/r/1971>
- [58] [CITE@en[Bug 5848 – Write the "fetching" section]]
([TIME[2015-02-07 01:27:20 +09:00]] 版)
<https://www.w3.org/Bugs/Public/show_bug.cgi?id=5848>
- [52] [CITE@en[Web Applications 1.0 r2074 Define event loops, task queues, etc; Make 'fetching' use this mechanism (everything will in due course); Fix some cross-references around 'interactive content'.]]
([TIME[2008-08-16 09:52:00 +09:00]] 版)
<https://html5.org/r/2074>
]REFS]

[51] [CITE@en[Web Applications 1.0 r2525  CSRF mitigation -- add Origin header to all non-GET requests.]]
([TIME[2008-12-02 20:26:00 +09:00]] 版)
<https://html5.org/r/2525>

[49] [CITE@en[Web Applications 1.0 r4084 Clarify how pushState() and transfering nodes between documents affects Referer: computation in the fetch algorithm.]]
([TIME[2009-10-06 08:39:00 +09:00]] 版)
<https://html5.org/r/4084>

[50] [CITE@en[Web Applications 1.0 r4011 Synchronise with the latest Origin spec rules and semantics.]]
([TIME[2009-09-29 08:51:00 +09:00]] 版)
<https://html5.org/r/4011>

[1] [CITE@en[Web Applications 1.0 r5451     Define how to handle <img src='mailto:foo@example.com'>Fixing http://www.w3.org/Bugs/Public/show_bug.cgi?id=10247]]
( ([TIME[2010-09-09 07:39:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=5450&to=5451>

[2] [CITE[Widget Access Request Policy]]
( ([TIME[2012-02-04 04:00:27 +09:00]] 版))
<http://dev.w3.org/2006/waf/widgets-access/>

[3] [CITE['''['''whatwg''']''' Image cache behaviour]]
([TIME[2012-03-22 13:10:14 +09:00]] 版)
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-March/035137.html>

[4] [CITE[295942 – Mozilla will ignore javascript-triggered image reload even if image is expired]]
([TIME[2012-03-22 14:20:52 +09:00]] 版)
<https://bugzilla.mozilla.org/show_bug.cgi?id=295942>

[5] [CITE[''''''[''''''whatwg'''''']'''''' '''['''html5''']''' r7128 - '''['''giow''']''' (2) Try to define img synchronous loading. Affected topics: HTML]]
( ([TIME[2012-06-14 02:29:09 +09:00]] 版))
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-June/036386.html>

[6] [CITE@en[Debunking Responsive CSS Performance Myths - igvita.com]]
( ([[Ilya Grigorik]] 著, [TIME[2012-06-21 08:08:59 +09:00]] 版))
<http://www.igvita.com/2012/06/14/debunking-responsive-css-performance-myths/>

** HTML への CORS の導入

;; [60] これまでの [[CORS]] の歴史は、 [[CORS]] の項を参照。

[7] [CITE@en[Web Applications 1.0 r7297     Cleanup of the 'potentially CORS-enabled fetch' algorithm to actually make sense.]]
( ([TIME[2012-08-30 05:29:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=7296&to=7297>

[8] [CITE@en[Web Applications 1.0 r7341     Attempt to actually define what Referer headers are used for a whole host of things that were poorly defined. Also: cleanup of a bunch of editorial mistakes I found from past such attempts. Mark every fetch algorithm use for sanity in the future. Block data:, javascript:, and about:blank referrers. Note: This relies on not-yet-done changes to CORS and XHR.]]
( ([TIME[2012-09-13 08:14:00 +09:00]] 版))
<http://html5.org/tools/web-apps-tracker?from=7340&to=7341>

** Fetch Standard

[61] [[Web Applications 1.0]] (現 [[HTML Standard]]) の [[fetch]]
は従来の [[fetch]] に[[猿パッチ]]のような形で [[CORS]] を継ぎ足していたため複雑で、
リファクタリングが必要と言われていましたが、いつどのような形で行うかは未定でした。
[[Ian Hickson]] は改訂の必要性は認めつつも、他の作業より優先度は低いとしていました。
[[annevk]] は2012年夏に ([[Opera]] および) [[W3C]] を離れたのを機に
[[XHR]] や [[CORS]] を [[WHATWG]] に移管しましたが、 [[CORS]] と [[fetch]]
を統合して整理する必要があるとし、 [[WHATWG]] [[CORS]] 仕様書の[[ドメイン名]]に
「fetch」を選びました [SRC[>>9]]。

[9] [CITE@en-US[Cross-Origin Resource Sharing Standard]]
( ([TIME[2012-09-13 21:51:45 +09:00]] 版))
<http://fetch.spec.whatwg.org/>

[10] [CITE[IRC logs: freenode / #whatwg / 20121126]]
( ([TIME[2012-12-09 01:19:22 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20121126>

[11] [CITE[IRC logs: freenode / #whatwg / 20130211]]
( ([TIME[2013-02-16 17:09:58 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130211>

[12] [CITE[IRC logs: freenode / #whatwg / 20130225]]
( ([TIME[2013-03-02 19:44:27 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130225#l-697>

[13] [CITE[IRC logs: freenode / #whatwg / 20130305]]
( ([TIME[2013-03-12 20:47:52 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130305>

[14] [CITE[IRC logs: freenode / #whatwg / 20130305]]
( ([TIME[2013-03-12 20:47:52 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130305#l-151>

[15] [CITE[IRC logs: freenode / #whatwg / 20130315]]
( ([TIME[2013-03-27 00:16:47 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130315#l-704>

[16] [CITE@en[HTTP Fetch Policy - WHATWG Wiki]]
( ([TIME[2013-03-24 05:08:34 +09:00]] 版))
<http://wiki.whatwg.org/wiki/HTTP_Fetch_Policy>

[17] [CITE[IRC logs: freenode / #whatwg / 20130411]]
( ([TIME[2013-04-13 15:40:14 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130411#l-686>

[18] [CITE[IRC logs: freenode / #whatwg / 20130415]]
( ([TIME[2013-04-19 08:52:25 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130415#l-416>

[19] [CITE[IRC logs: freenode / #whatwg / 20130418]]
( ([TIME[2013-04-25 21:57:07 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130418#l-839>

[20] [CITE[IRC logs: freenode / #whatwg / 20130422]]
( ([TIME[2013-05-03 23:39:29 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130422#l-691>

[21] [CITE[IRC logs: freenode / #whatwg / 20130502]]
( ([TIME[2013-05-12 22:30:49 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130502>

[22] [CITE[''''''[''''''whatwg'''''']'''''' Fetch: please review!]]
( ([TIME[2013-05-22 09:50:41 +09:00]] 版))
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-May/039600.html>

[23] [CITE@en[Fetch groups]]
( ([[Anne van Kesteren]] 著, [TIME[2013-06-25 23:09:37 +09:00]] 版))
<http://lists.w3.org/Archives/Public/www-archive/2013Jun/0086.html>

[24] [CITE@en[Re: CSP and Fetch]]
( ([[Anne van Kesteren]] 著, [TIME[2014-01-24 09:36:13 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0161.html>

[25] [CITE[IRC logs: freenode / #whatwg / 20140520]]
( ([TIME[2014-05-23 19:04:39 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20140520>

[26] [CITE[Sketch for Fetch API, details and organization TBD · b40f990 · whatwg/fetch]]
( ([TIME[2014-05-29 04:54:26 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/b40f99003d31abfe23bbcd84d13e62c52d6267ce>

[27] [CITE[Request constructor and fetch() method, add RedirectResponse named const... · 2e82a88 · whatwg/fetch]]
( ([TIME[2014-05-29 11:05:37 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/2e82a88634f0cd23de1977b11b36d1e907d01f5c>

[28] [CITE[Clean up new Request and fetch() · 97f680c · whatwg/fetch]]
( ([TIME[2014-05-30 02:50:41 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/97f680c318a4b4bdc461ae607f245fe1441b6877>

[29] [CITE[Clean up fetch() steps · 3445fc0 · whatwg/fetch]]
( ([TIME[2014-05-30 02:51:06 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/3445fc0f4f667bd9aa2487351330cea82c93885f>

[30] [CITE@en[Fetch API]]
( ([[Anne van Kesteren]] 著, [TIME[2014-05-29 21:57:01 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webapps/2014AprJun/0687.html>

[31] [CITE[Update request's referrer per https://www.w3.org/Bugs/Public/show_bug.cg... · 8ab38bf · whatwg/fetch]]
( ([TIME[2014-06-14 13:51:23 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/8ab38bf62ace6c221c544add7cc188c799d6acc7>

[32] [CITE[IRC logs: freenode / #whatwg / 20140812]]
( ([TIME[2014-08-13 10:20:45 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20140812>

[33] [CITE[Dependencies & weights (aka, priority) - Google ドキュメント]]
( ([TIME[2014-08-15 02:18:51 +09:00]] 版))
<https://docs.google.com/document/d/1jSpWc6jkrUoYtGWcxev9Blkkv9RhoO1XtqinBvXqhgY/edit>

[34] [CITE[Request Quest]]
( ([TIME[2013-06-28 16:18:32 +09:00]] 版))
<http://jakearchibald.github.io/request-quest/>

[35] [CITE@en[Web Applications 1.0 r8799 Stop using the word 'asynchronously', and reduce usage of the word 'synchronous'.]]
( ([TIME[2014-09-20 08:19:00 +09:00]] 版))
<https://html5.org/r/8799>

[36] [CITE@en[Web Applications 1.0 r8846 Rename API referrer source to just referrer source, for fetch]]
( ([TIME[2014-11-08 07:42:00 +09:00]] 版))
<https://html5.org/r/8846>

[37] [CITE[IRC logs: freenode / #whatwg / 20130624]]
( ([TIME[2013-06-29 00:36:47 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20130624>

[38] [CITE[Fetch integration. Please review, this is major. MAJOR. Right. · c99000a · whatwg/xhr]]
( ([TIME[2013-10-30 06:06:33 +09:00]] 版))
<https://github.com/whatwg/xhr/commit/c99000a96dada32b0aed566563c759256f0b2d9a>

[39] [CITE@en[XMLHttpRequest and Fetch]]
( ([[Anne van Kesteren]] 著, [TIME[2013-10-23 01:44:25 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webapps/2013OctDec/0237.html>

[40] [CITE[Fetch is the new CORS (and more). Also fix a few minor bugs thanks to @j... · 9b60830 · whatwg/xhr]]
( ([TIME[2014-01-08 07:23:20 +09:00]] 版))
<https://github.com/whatwg/xhr/commit/9b608301704e6360f905e1a93f9310e209fec5a5>

[41] [CITE[Rely more on Fetch. More to come. · a50621b · whatwg/xhr]]
( ([TIME[2014-01-08 07:23:25 +09:00]] 版))
<https://github.com/whatwg/xhr/commit/a50621b2247dc42a2e9521f5055a4d5b71d0685e>

[42] [CITE[Move some request security checks to Fetch so other APIs can do the same... · 126f3db · whatwg/xhr]]
( ([TIME[2014-01-08 07:25:56 +09:00]] 版))
<https://github.com/whatwg/xhr/commit/126f3db30a67ff2be772ae3682206011d89301eb>

[43] [CITE[Flashと特定ブラウザの組み合わせでcross originでカスタムヘッダ付与が出来てしまう問題が未だに直っていない話]]
( ([TIME[2014-02-19 08:05:06 +09:00]] 版))
<https://gist.github.com/mala/8857629>

[44] [CITE[カスタムヘッダを使ったCSRF対策は安全に使えるかどうかということについて - 金利0無利息キャッシング – キャッシングできます - subtech]]
( ([TIME[2014-02-19 08:15:55 +09:00]] 版))
<http://subtech.g.hatena.ne.jp/mala/20130304/1362392723>

[45] [CITE[IRC logs: freenode / #whatwg / 20140515]]
( ([TIME[2014-05-17 18:12:00 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20140515>

[46] [CITE[REFERRER: Cleaning up the integration with Fetch. · 82e1046 · w3c/webappsec]]
( ([TIME[2014-06-16 03:04:34 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/82e1046cd2d00c4b286abdf3a336511207ff9750>


[63] [CITE@en[Extract networking into its own set of steps to prepare for https://www.... · 6c10655 · whatwg/fetch]]
([TIME[2015-02-19 12:30:35 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/6c10655c960d0cd95d739d1604f48c11828e9499>

[64] [CITE@en[Introduce HTTP request grouping for https://www.w3.org/Bugs/Public/show_... · 44546f2 · whatwg/fetch]]
([TIME[2015-02-19 12:31:42 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/44546f2f850bdd49bd08d44ce68188b9ba239a93>

[FIG(quote)[
[FIGCAPTION[
[65] [CITE@en[Chromium Blog: Chrome 42 Beta: Push Notifications, Promoting Add to Home Screen and ES6 Classes]]
([TIME[2015-03-14 09:17:20 +09:00]] 版)
<http://blog.chromium.org/2015/03/chrome-42-beta-push-notifications_12.html>
]FIGCAPTION]

> The Fetch API is now available in the window context, shared workers, and dedicated workers, providing a new promise-based standard for AJAX requests.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[66] ([TIME[2009-08-03 07:55:07 +09:00]] 版)
<http://www.adambarth.com/papers/2009/jackson-barth-bortz-shao-boneh-tweb.pdf>
]FIGCAPTION]

> Prohibited access. Some kinds of network access are prohibited even within
> the same origin. Internet Explorer 7 blocks port numbers 19 (chargen), 21
> (FTP), 25 (SMTP), 110 (POP3), 119 (NNTP), and 143 (IMAP). Firefox 2 and
> Safari 3 block those plus 51 additional port numbers. Some of these port restrictions
> prevent Web sites from launching denial-of-service attacks or sending
> spam email, whereas others prevent universal cross-site scripting via the
> HTML form protocol attack [Topf 2001].

]FIG]


[FIG(quote)[
[FIGCAPTION[
[67] [CITE[IRC logs: freenode / #whatwg / 20150330]]
([TIME[2015-03-31 11:13:04 +09:00]] 版)
<http://krijnhoetmer.nl/irc-logs/whatwg/20150330#l-171>
]FIGCAPTION]

> # '''['''10:39''']''' <JakeA> annevk: when is the right time to make response/request.body a ReadableStream in the fetch spec?
> # '''['''11:08''']''' <annevk> JakeA: I was waiting for "tee" to be defined

]FIG]


[68] [CITE@en[Preparation for merge · Issue #25 · yutakahirano/fetch-with-streams]]
([TIME[2015-03-31 11:14:16 +09:00]] 版)
<https://github.com/yutakahirano/fetch-with-streams/issues/25>

[FIG(quote)[
[FIGCAPTION[
[69] [CITE[IRC logs: freenode / #whatwg / 20150330]]
([TIME[2015-03-31 11:14:58 +09:00]] 版)
<http://krijnhoetmer.nl/irc-logs/whatwg/20150330#l-171>
]FIGCAPTION]

> 
> # '''['''15:42''']''' <wanderview> annevk: at this point I do not feel comfortable implementing that... I'm planning to talk to sicking in a couple weeks to try to iron out our differences
> # '''['''15:45''']''' <annevk> JakeA: given wanderview's statement and not hearing anything from Apple/Microsoft I'm inclined to hold off on integrating streams for now
> # '''['''15:47''']''' <JakeA> annevk: makes sense, wasn't aware of wanderview's concerns
> # '''['''15:47''']''' <wanderview> annevk: I guess to clarify, I'm personally ok with implementing the fetch body stream bit... but I need to address sicking's concerns first... and it feels like we're further away from agreement than I thought before
> # '''['''15:49''']''' <wanderview> JakeA: not my personal concerns... we need some internal consensus before moving forward, though

]FIG]


[70] [CITE@en[Integrate with UPGRADE. Fixes https://www.w3.org/Bugs/Public/show_bug.cg... · whatwg/fetch@fd90b5a]]
([TIME[2015-03-31 11:21:26 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/fd90b5afd0ff09284c2a3cd093c577d17ce06898>

[71] [CITE@en[Prefer GitHub participation. Use URLs that include the scheme. · whatwg/fetch@4b58ddc]]
([TIME[2015-04-06 11:37:17 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/4b58ddc9435411eb5f7698d961e57d512f0f541b>