Pass a top-level navigation initiator origin to Fetch #10991
Conversation
To un-logjam the cookie layering work, I've started whatwg/fetch#1807. That depends on this info to be piped into Fetch so we can actually specify in WHATWG what SameSite=Strict means. This patch plumbs that through on top-level navigatable fetches. This doesn't build because it relies upon the corresponding patch in Fetch. Let me know to land these.
| @@ -102636,6 +102636,11 @@ location.href = '#foo';</code></pre> | |||
| <dt><span data-x="concept-request-referrer-policy">referrer policy</span></dt> | |||
| <dd><var>entry</var>'s <span data-x="she-document-state">document state</span>'s <span | |||
| data-x="document-state-request-referrer-policy">request referrer policy</span></dd> | |||
|
|
|||
| <dt><span data-x="concept-request-navigation-initiator-origin">navigation initiator origin</span></dt> | |||
There was a problem hiding this comment.
If this is the new Fetch concept you'll have to introduce that definition in an earlier section that introduces all the Fetch terms HTML uses. (HTML doesn't use Bikeshed's link database unfortunately.)
| <dt><span data-x="concept-request-navigation-initiator-origin">navigation initiator origin</span></dt> | ||
| <dd><var>entry</var>'s <span data-x="she-document-state">document state</span>'s <span | ||
| data-x="document-state-initiator-origin">initiator origin</span> if <var>navigable</var> is a <span>top-level traversable</span>, | ||
| null otherwise.</dd> |
There was a problem hiding this comment.
Given that this is conditional, perhaps it's best conditionally set to a value as a follow-up step, leaving it as the default otherwise?
But also, this doesn't seem sufficient for A->B->A scenarios.
There was a problem hiding this comment.
Sure, that sounds reasonable.
This is only for the definition of SameSite=Lax, so it isn't needed for ABA, only for top-level traversables if I'm remembering right. Maybe I should rename the variable to something more descriptive, reflecting how it will be used? Alternatively, we can always set it and filter on the request's destination being a Document. I'm open to either.
| initiator origin</span> to <var>entry</var>'s <span data-x="she-document-state">document | ||
| state</span>'s <span data-x="document-state-initiator-origin">initiator origin</span> | ||
| </p> | ||
| </li> |
There was a problem hiding this comment.
Please have a look at the formatting guidelines. This isn't quite it.
To un-logjam the cookie layering work, I've started whatwg/fetch#1807. That depends on this info to be piped into Fetch so we can actually specify in WHATWG what SameSite=Strict means.
This patch plumbs that through on top-level navigatable fetches.
This doesn't build because it relies upon the corresponding patch in Fetch. Let me know to land these.
(See WHATWG Working Mode: Changes for more details.)