Skip to content

Commit

Permalink
Fix #39: drop cache mode "only-if-cached" per security review
Browse files Browse the repository at this point in the history
  • Loading branch information
@annevk
annevk committed Nov 6, 2015
1 parent a58871a commit 886255d
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 44 deletions.
30 changes: 8 additions & 22 deletions Overview.html
View file
Expand Up @@ -817,8 +817,7 @@ <h4 id="requests"><span class="secno">3.1.5 </span>Requests</h4>
<p>A <a href="#concept-request" title="concept-request">request</a> has an associated
<dfn id="concept-request-cache-mode" title="concept-request-cache-mode">cache mode</dfn>, which is one of
"<code title="">default</code>", "<code title="">no-store</code>", "<code title="">reload</code>",
"<code title="">no-cache</code>", "<code title="">force-cache</code>", and
"<code title="">only-if-cached</code>". Unless stated otherwise, it is
"<code title="">no-cache</code>", and "<code title="">force-cache</code>". Unless stated otherwise, it is
"<code title="">default</code>".

<p class="note no-backref">If <a href="#concept-request-header-list" title="concept-request-header-list">header list</a>
Expand Down Expand Up @@ -2571,11 +2570,9 @@ <h3 id="http-network-or-cache-fetch"><span class="secno">5.4 </span>HTTP-network
<!-- XXX xref "HTTP cache" -->

<ol>
<li><p>If <var>httpRequest</var>'s
<a href="#concept-request-cache-mode" title="concept-request-cache-mode">cache mode</a> is either
"<code title="">force-cache</code>" or "<code title="">only-if-cached</code>", set <var>response</var>
to the <a href="#concept-response" title="concept-response">response</a> in the HTTP cache for
<var>httpRequest</var>.
<li><p>If <var>httpRequest</var>'s <a href="#concept-request-cache-mode" title="concept-request-cache-mode">cache mode</a> is
"<code title="">force-cache</code>", set <var>response</var> to the
<a href="#concept-response" title="concept-response">response</a> in the HTTP cache for <var>httpRequest</var>.

<li><p>Otherwise, if <var>httpRequest</var>'s
<a href="#concept-request-cache-mode" title="concept-request-cache-mode">cache mode</a> is "<code title="">default</code>" and
Expand Down Expand Up @@ -2605,19 +2602,9 @@ <h3 id="http-network-or-cache-fetch"><span class="secno">5.4 </span>HTTP-network
<a href="#concept-header" title="concept-header">headers</a>.
<!-- XXX xref partial, modify, resume headers -->

<li>
<p>If <var>response</var> is null, run these substeps:

<ol>
<li><p>If <var>httpRequest</var>'s
<a href="#concept-request-cache-mode" title="concept-request-cache-mode">cache mode</a> is
"<code title="">only-if-cached</code>", return a
<a href="#concept-network-error" title="concept-network-error">network error</a>.

<li><p>Set <var>response</var> to the result of making an
<a href="#concept-http-network-fetch" title="concept-http-network-fetch">HTTP-network fetch</a> using
<var>httpRequest</var> with the <i title="">credentials flag</i> set if set.
</ol>
<li><p>If <var>response</var> is null, set <var>response</var> to the result of making an
<a href="#concept-http-network-fetch" title="concept-http-network-fetch">HTTP-network fetch</a> using <var>httpRequest</var> with
the <i title="">credentials flag</i> set if set.

<li>
<p>If <var>response</var>'s <a href="#concept-status" title="status">status</a> is <code>304</code>, run these
Expand Down Expand Up @@ -2814,7 +2801,6 @@ <h3 id="http-network-fetch"><span class="secno">5.5 </span>HTTP-network fetch</h
<a href="#concept-request-cache-mode" title="concept-request-cache-mode">cache mode</a> is not "<code title="">no-store</code>",
update <var>response</var> in the HTTP cache for <var>request</var>.
<!-- XXX xref HTTP cache -->
<!-- Note: at this point cache mode cannot be /only-if-cached/ -->

<li>
<p>If <var>credentials flag</var> is set and <var>response</var>'s
Expand Down Expand Up @@ -3658,7 +3644,7 @@ <h3 id="request-class"><span class="secno">6.3 </span>Request class</h3>
enum <dfn id="requestdestination">RequestDestination</dfn> { "", "document", "sharedworker", "subresource", "unknown", "worker" };
enum <dfn id="requestmode">RequestMode</dfn> { "navigate", "same-origin", "no-cors", "cors" };
enum <dfn id="requestcredentials">RequestCredentials</dfn> { "omit", "same-origin", "include" };
enum <dfn id="requestcache">RequestCache</dfn> { "default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached" };
enum <dfn id="requestcache">RequestCache</dfn> { "default", "no-store", "reload", "no-cache", "force-cache" };
enum <dfn id="requestredirect">RequestRedirect</dfn> { "follow", "error", "manual" };</pre>

<p class="note no-backref">"<code>serviceworker</code>" is omitted from
Expand Down
30 changes: 8 additions & 22 deletions Overview.src.html
View file
Expand Up @@ -756,8 +756,7 @@ <h4>Requests</h4>
<p>A <span title=concept-request>request</span> has an associated
<dfn title=concept-request-cache-mode>cache mode</dfn>, which is one of
"<code title>default</code>", "<code title>no-store</code>", "<code title>reload</code>",
"<code title>no-cache</code>", "<code title>force-cache</code>", and
"<code title>only-if-cached</code>". Unless stated otherwise, it is
"<code title>no-cache</code>", and "<code title>force-cache</code>". Unless stated otherwise, it is
"<code title>default</code>".

<p class="note no-backref">If <span title=concept-request-header-list>header list</span>
Expand Down Expand Up @@ -2510,11 +2509,9 @@ <h3>HTTP-network-or-cache fetch</h3>
<!-- XXX xref "HTTP cache" -->

<ol>
<li><p>If <var>httpRequest</var>'s
<span title=concept-request-cache-mode>cache mode</span> is either
"<code title>force-cache</code>" or "<code title>only-if-cached</code>", set <var>response</var>
to the <span title=concept-response>response</span> in the HTTP cache for
<var>httpRequest</var>.
<li><p>If <var>httpRequest</var>'s <span title=concept-request-cache-mode>cache mode</span> is
"<code title>force-cache</code>", set <var>response</var> to the
<span title=concept-response>response</span> in the HTTP cache for <var>httpRequest</var>.

<li><p>Otherwise, if <var>httpRequest</var>'s
<span title=concept-request-cache-mode>cache mode</span> is "<code title>default</code>" and
Expand Down Expand Up @@ -2544,19 +2541,9 @@ <h3>HTTP-network-or-cache fetch</h3>
<span title=concept-header>headers</span>.
<!-- XXX xref partial, modify, resume headers -->

<li>
<p>If <var>response</var> is null, run these substeps:

<ol>
<li><p>If <var>httpRequest</var>'s
<span title=concept-request-cache-mode>cache mode</span> is
"<code title>only-if-cached</code>", return a
<span title=concept-network-error>network error</span>.

<li><p>Set <var>response</var> to the result of making an
<span title=concept-http-network-fetch>HTTP-network fetch</span> using
<var>httpRequest</var> with the <i title>credentials flag</i> set if set.
</ol>
<li><p>If <var>response</var> is null, set <var>response</var> to the result of making an
<span title=concept-http-network-fetch>HTTP-network fetch</span> using <var>httpRequest</var> with
the <i title>credentials flag</i> set if set.

<li>
<p>If <var>response</var>'s <span title=status>status</span> is <code>304</code>, run these
Expand Down Expand Up @@ -2753,7 +2740,6 @@ <h3>HTTP-network fetch</h3>
<span title=concept-request-cache-mode>cache mode</span> is not "<code title>no-store</code>",
update <var>response</var> in the HTTP cache for <var>request</var>.
<!-- XXX xref HTTP cache -->
<!-- Note: at this point cache mode cannot be /only-if-cached/ -->

<li>
<p>If <var>credentials flag</var> is set and <var>response</var>'s
Expand Down Expand Up @@ -3597,7 +3583,7 @@ <h3>Request class</h3>
enum <dfn>RequestDestination</dfn> { "", "document", "sharedworker", "subresource", "unknown", "worker" };
enum <dfn>RequestMode</dfn> { "navigate", "same-origin", "no-cors", "cors" };
enum <dfn>RequestCredentials</dfn> { "omit", "same-origin", "include" };
enum <dfn>RequestCache</dfn> { "default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached" };
enum <dfn>RequestCache</dfn> { "default", "no-store", "reload", "no-cache", "force-cache" };
enum <dfn>RequestRedirect</dfn> { "follow", "error", "manual" };</pre>

<p class="note no-backref">"<code>serviceworker</code>" is omitted from
Expand Down

0 comments on commit 886255d

Please sign in to comment.