diff --git a/fetch.bs b/fetch.bs index a845d5ab9..bbabc5083 100644 --- a/fetch.bs +++ b/fetch.bs @@ -1196,6 +1196,58 @@ downloads. This format of range header value can be set using add a range hea implementation-defined header value for the `User-Agent` header. +

To +filter include a +header list list and a list of names includeNames, run these steps: + +

    +

  1. Let filteredList be an empty header list. + +

  2. For each (name, value) in list: + +

      +

    1. If name is in includeNames, then append (name, value) to filteredList. +

    + +

  3. Return filteredList. +

+ +

To +filter exclude a +header list list and a list of names excludeNames, run these steps: + +

    +

  1. Let filteredList be an empty header list. + +

  2. For each (name, value) in list: + +

      +

    1. If name not in excludeNames then append (name, value) to filteredList. +

    + +

  3. Return filteredList. +

+ +

To +get the size of a +header list list, run these steps: + +

    +

  1. Let sizeInBytes be `0`. + +

  2. For each (name, value) in list: + +

      +

    1. Add the length of name to sizeInBytes. +

    2. Add the length of value to sizeInBytes. +

    3. Add 4 to sizeInBytes (represents the `: ` after the name and the `\r\n` after the value). +

    + +

  3. Return sizeInBytes. +

+ +Note: The 4 bytes added to account for the HTTP/1 syntax may need to be adjusted for different/updates syntaxes. +

Statuses

@@ -2970,6 +3022,33 @@ run these steps:

  • Return allowed. +

    +Is a cross-origin request's header size over the limit?

    + +Note: The goal of this algorithm is to prevent cross-origin requests from probing the size of sensitive headers +(`Authorization` or `Cookie`) by adding headers +to cross-origin requests until the total size of all HTTP request headers exceeds the server side limit. If this +algorithm returns true, the CORS-preflight request must be run. In order for this approach to succeed, servers should +not set an HTTP request headers size limit below 8 kibibyte. + +

    Run these steps to check if the header size is over the cross-origin limits on the provided request: + +

      +

    1. If request's origin is same origin with request's + current URL's origin, return `false`. + +

    2. Let sensitiveHeaderList be the result of running filter include on request's + header list with `(Authorization, Cookie) as includeNames`. + +

    3. If the result of running get the size on sensitiveHeaderList is greater than 4 kibibyte, return `true`. + +

    4. Let nonSensitiveHeaderList be the result of running filter exclude on request's + header list with `(Authorization, Cookie) as excludeNames`. + +

    5. If the result of running get the size on nonSensitiveHeaderList is greater than 4 kibibyte, return `true`. + +

    6. Return `false`. +

    HTTP extensions

    @@ -4732,18 +4811,19 @@ these steps:
    1. -

      If makeCORSPreflight is true and one of these conditions is true: +

      If one of these conditions is true:

      +

    2. makeCORSPreflight is true and there is at least one item in the + CORS-unsafe request-header names with request's header list + for which there is no header-name cache entry match using request. + +

    3. The header size is over the cross-origin limits given request returns true.

      Then: