diff --git a/fetch.bs b/fetch.bs index a5c2cb26c..bac7ede94 100644 --- a/fetch.bs +++ b/fetch.bs @@ -39,6 +39,10 @@ urlPrefix:https://tc39.es/ecma262/#;type:dfn;spec:ecma-262 url:sec-list-and-record-specification-type;text:Record +
+  spec:infra; type:dfn; text:user agent
+
+ 
 {
     "HTTP": {
@@ -1773,8 +1777,8 @@ to not have to set request's referrer.
 
A request has an associated
 mode, which is
 "same-origin", "cors", "no-cors",
-"navigate", or "websocket". Unless stated otherwise, it is
-"no-cors".
+"navigate", "user-agent-no-cors", or "websocket".
+Unless stated otherwise, it is "no-cors".
 
 

  

@@ -1796,6 +1800,21 @@ to not have to set request's referrer.
   
"navigate"
   
This is a special mode used only when navigating between documents.
 
+  
"user-agent-no-cors"
+  
This is a special mode for the [=user agent=] to use internally to wittingly make
+  requests that are unsafe. It restricts a request to using CORS-safelisted methods,
+  CORS-safelisted request-headers, and the request must have a parallel queue
+  task destination. A request with this mode cannot use
+  service-workers mode "all". However, the request will not be required to
+  pass a cross-origin resource policy check or to test if
+  Cross-Origin-Embedder-Policy allows credentials. Upon success a fetch will
+  return a basic filtered response.
+
+  
 Using request mode "user-agent-no-cors"
+  is even more discouraged and unsafe than "no-cors". Any use of this mode must be
+  memory-isolated to the [=user agent=] to contain its results and prevent their disclosure or misuse.
+  This mode is deliberately not exposed in the {{RequestMode}}.
+
   
"websocket"
   
This is a special mode used only when
   establishing a WebSocket connection.
@@ -1803,8 +1822,16 @@ to not have to set request's referrer.
 
  
Even though the default request mode is "no-cors",
  standards are highly discouraged from using it for new features. It is rather unsafe.
+
+
 

 
+
A request has an associated
+omit origin flag. Unless stated otherwise it is unset.
+
+
The omit origin flag only has effect when
+request's mode is "user-agent-no-cors".
+
 
A request has an associated
 use-CORS-preflight flag. Unless stated
 otherwise, it is unset.
@@ -3074,8 +3101,9 @@ given a request request, run these steps:
  with request.
 
  
  • If request's response tainting is "cors" or
- request's mode is "websocket", then
- append (`Origin`, serializedOrigin) to
+ request's mode is "websocket" or
+ "user-agent-no-cors", then append
+ (`Origin`, serializedOrigin) to
  request's header list.
 
  
  • 
@@ -3981,6 +4009,10 @@ the request.
   
    Assert: request's mode is "navigate" or
   processEarlyHintsResponse is null.
 
+  
    If fetchParams's request's mode is
+  "user-agent-no-cors": assert: fetchParams's
+  task destination is a parallel queue.
+
   
    Processing of early hints (responses whose status
   is 103) is only vetted for navigations.
 
@@ -4039,7 +4071,9 @@ the request.
  global object is a {{Window}} object; otherwise
  "no-window".
 
- 
  • If request's origin is "client", then set
+ 
  • If request's origin is "client" and either
+ request's mode is not "user-agent-no-cors" or
+ and request's omit origin flag is unset, then set
  request's origin to  request's client's
  origin.
 
@@ -4051,7 +4085,7 @@ the request.
    HTTP(S) scheme
 
    
  • request's mode is "same-origin",
-   "cors", or "no-cors"
+   "cors", "no-cors", or "user-agent-no-cors"
 
    
  • request's window is not null
 
@@ -4066,7 +4100,8 @@ the request.
   
      
    
    1. Assert: request's origin is same origin
    with request's client's
-   origin.
+   origin or request's mode
+   is "user-agent-no-cors".
 
    
    2. Let onPreloadedResponseAvailable be an algorithm that runs the following
    step given a response response: set fetchParams's
@@ -4302,6 +4337,15 @@ steps:
      
    3. Return corsWithPreflightResponse.
     
    
 
+   
    request's mode is "user-agent-no-cors"
+   
    
+    
      
+     
    1. Set request's response tainting to
+     "basic".
+
+     
    2. Return the result of running HTTP fetch given fetchParams.
+    
    
+
    
    Otherwise
    
    
     
      
@@ -4788,6 +4832,8 @@ these steps:
        
    1. request's mode is not "no-cors" and
        response's type is "opaque"
 
+       
    2. request's mode is "user-agent-no-cors"
+
        
    3. request's redirect mode is not "manual" and
        response's type is "opaqueredirect"
 
@@ -5144,7 +5190,9 @@ run these steps:
      httpRequest's header list.
     
    
 
-   
  • Append a request `Origin` header for httpRequest.
+   
  • If either request's mode is not "user-agent-no-cors"
+   or request's omit origin flag is not set,
+   
    append a request `Origin` header for httpRequest.
 
    
  • Append the Fetch metadata headers for httpRequest.
    [[!FETCH-METADATA]]
@@ -8303,6 +8351,7 @@ Axel Rauschmayer,
 Ben Kelly,
 Benjamin Gruenbaum,
 Benjamin Hawkes-Lewis,
+Benjamin VanderSloot,
 Bert Bos,
 Björn Höhrmann,
 Boris Zbarsky,