diff --git a/Overview.html b/Overview.html index e040ffccc..0ed09e0fa 100644 --- a/Overview.html +++ b/Overview.html @@ -7,7 +7,7 @@

Fetch

-

Living Standard — Last Updated 25 March 2016

+

Living Standard — Last Updated 30 March 2016

Participate: @@ -451,7 +451,7 @@

3.1.2 Headers

A CORS-safelisted response-header name, given a -header list list, is a +CORS-exposed header-name list list, is a header name that is one of:

@@ -1111,6 +1109,19 @@

3.1.6 Responses

for the response. The list is empty unless otherwise specified. [CSP] +

A response has an associated +CORS-exposed header-name list +(a list of zero or more +header names). +The list is empty unless otherwise specified. + +

A response will typically get its +CORS-exposed header-name list +set by parsing the +`Access-Control-Expose-Headers` header. This +list is used by a CORS filtered response to +determine which headers to expose. +

A response whose @@ -1162,7 +1173,7 @@

3.1.6 Responses

name is not a CORS-safelisted response-header name, given internal response's -header list. +CORS-exposed header-name list.

An opaque filtered response is a filtered response whose @@ -2104,22 +2115,37 @@

5.1 Main fetch

If response is not a network error and response is not a - filtered response, set - response to the following - filtered response with - response as its - internal response, depending on - request's - response tainting: - -

-
"basic" -
basic filtered response -
"cors" -
CORS filtered response -
"opaque" -
opaque filtered response -
+ filtered response, run these substeps: + +
    +
  1. +

    If request's + response tainting is + "cors", set + response's + CORS-exposed header-name list + to the result of parsing + `Access-Control-Expose-Headers` in + response's + header list. + +

  2. +

    Set response to the following + filtered response with + response as its + internal response, depending on + request's + response tainting: + +

    +
    "basic" +
    basic filtered response +
    "cors" +
    CORS filtered response +
    "opaque" +
    opaque filtered response +
    +

  • Let internalResponse be response, if response is a network error, and response's @@ -5205,6 +5231,7 @@

    Acknowledgments

    Manish Goregaokar, Marc Silbey, Marcos Caceres, +Marijn Kruisselbrink, Mark Nottingham, Mark S. Miller, Martin Dürst, diff --git a/Overview.src.html b/Overview.src.html index 0119a0ca1..b8144f0ce 100644 --- a/Overview.src.html +++ b/Overview.src.html @@ -382,7 +382,7 @@

    Headers

    A CORS-safelisted response-header name, given a -header list list, is a +CORS-exposed header-name list list, is a header name that is one of:

      @@ -392,9 +392,7 @@

      Headers

    • `Expires`
    • `Last-Modified`
    • `Pragma`. -
    • Any value resulting from - parsing - `Access-Control-Expose-Headers` in +
    • Any value in list that is not a forbidden response-header name.
    @@ -1042,6 +1040,19 @@

    Responses

    for the response. The list is empty unless otherwise specified. CSP +

    A response has an associated +CORS-exposed header-name list +(a list of zero or more +header names). +The list is empty unless otherwise specified. + +

    A response will typically get its +CORS-exposed header-name list +set by parsing the +`Access-Control-Expose-Headers` header. This +list is used by a CORS filtered response to +determine which headers to expose. +

    A response whose @@ -1093,7 +1104,7 @@

    Responses

    name is not a CORS-safelisted response-header name, given internal response's -header list. +CORS-exposed header-name list.

    An opaque filtered response is a filtered response whose @@ -2035,22 +2046,37 @@

    Main fetch

    If response is not a network error and response is not a - filtered response, set - response to the following - filtered response with - response as its - internal response, depending on - request's - response tainting: - -

    -
    "basic" -
    basic filtered response -
    "cors" -
    CORS filtered response -
    "opaque" -
    opaque filtered response -
    + filtered response, run these substeps: + +
      +
    1. +

      If request's + response tainting is + "cors", set + response's + CORS-exposed header-name list + to the result of parsing + `Access-Control-Expose-Headers` in + response's + header list. + +

    2. +

      Set response to the following + filtered response with + response as its + internal response, depending on + request's + response tainting: + +

      +
      "basic" +
      basic filtered response +
      "cors" +
      CORS filtered response +
      "opaque" +
      opaque filtered response +
      +

  • Let internalResponse be response, if response is a network error, and response's @@ -5047,6 +5073,7 @@

    Acknowledgments

    Manish Goregaokar, Marc Silbey, Marcos Caceres, +Marijn Kruisselbrink, Mark Nottingham, Mark S. Miller, Martin Dürst,