diff --git a/opt-in.md b/opt-in.md index 6109ff0..bc0f12c 100644 --- a/opt-in.md +++ b/opt-in.md @@ -48,7 +48,8 @@ To resolve this problem, user agents must only preload pages which either: * Have no stored credentials (for prefetch) or storage of any kind (for prerender); or * Indicate that they are prepared to perform this sort of upgrade, by sending the appropriate `Supports-Loading-Mode` header value: either `uncredentialed-prefetch`, `uncredentialed-prerender`, or both. -_Note: these values are not currently implemented in Chromium._ +> **Note** +> `uncredentialed-prerender` is somewhat speculative at this point; see [cross-site prerendering](prerendering-cross-site.md) for some of the complexity there. ### Cross-origin same-site prerendering diff --git a/prefetch.bs b/prefetch.bs index 79b8627..538e172 100644 --- a/prefetch.bs +++ b/prefetch.bs @@ -116,6 +116,10 @@ spec: COOKIES; urlPrefix: https://httpwg.org/specs/rfc6265.html type: dfn; text: domain-matches; url: cookie-domain type: dfn; text: canonicalized host name; url: cookie-domain-canonicalize type: dfn; text: path-matches; url: cookie-path +spec: nav-speculation; urlPrefix: prerendering.html + type: dfn + text: getting the supported loading modes; url: get-the-supported-loading-modes + text: uncredentialed-prefetch; for: Supports-Loading-Mode; url: supports-loading-mode-uncredentialed-prefetch

Concepts

@@ -201,7 +205,7 @@ A cross-partition prefetch state is a [=struct=] with the following [ * isolated partition key, a [=network partition key=] whose first item is an [=opaque origin=] and which represents a separate partition in which state can be temporarily stored * origins with conflicting credentials, an [=ordered set=] of [=origins=] (initially empty) -

Prefetches which start in a different partition as their referrer (e.g., because the URL is cross-site) abort when they would return to that partition (and thus would be credentialed normally), and when an origin for which credentials would have been sent is encountered.

+

Prefetches which start in a different partition as their referrer (e.g., because the URL is cross-site) abort when they would return to that partition (and thus would be credentialed normally). Unless the response indicates otherwise using [:Supports-Loading-Mode:], a request which would have ordinarily sent credentials but could not due to cross-partition prefetch also causes a prefetch to be abandoned.

A [=prefetch record=]'s response is the [=exchange record/response=] of the last element of its [=prefetch record/redirect chain=], or null if that list [=list/is empty=]. @@ -478,11 +482,6 @@ A cross-origin prefetch IP anonymization policy has an This explicitly acknowledges that implementations might have additional restrictions. For instance, anonymized traffic might not be possible to some hosts, such as those that are not publicly routable and those that have traffic advice declining private prefetch traffic. - - 1. If |prefetchRecord|'s [=prefetch record/partition state=] is a [=cross-partition prefetch state=]: - 1. Let |hypotheticalEnvironment| be the result of [=creating a reserved client=] given |navigable|, |request|'s [=request/current URL=], and null. - 1. Let |hypotheticalPartitionKey| be the result of [=determining the network partition key=] given |hypotheticalEnvironment|. - 1. If there are [=credentials=] associated with |request|'s [=request/current URL=] and |hypotheticalPartitionKey|, then [=set/append=] |request|'s [=request/current URL=]'s [=url/origin=] to |prefetchRecord|'s [=prefetch record/partition state=]'s [=cross-partition prefetch state/origins with conflicting credentials=]. 1. [=redirect chain/Append=] |request| to |prefetchRecord|'s [=prefetch record/redirect chain=]. 1. Set |response| to null. 1. If |fetchController| is null, then set |fetchController| to the result of [=fetching=] |request|, with [=fetch/processEarlyHintsResponse=] set to |processEarlyHintsResponse| as defined below, [=fetch/processResponse=] set to |processResponse| as defined below, and [=fetch/useParallelQueue=] set to true. @@ -506,7 +505,15 @@ A cross-origin prefetch IP anonymization policy has an blocked, then set |response| to a [=network error=] and [=iteration/break=]. - 1. If |prefetchRecord| was given, then [=redirect chain/update the response=] for its [=prefetch record/redirect chain=] given |request| and |response|. + 1. If |prefetchRecord| was given, then: + 1. [=redirect chain/Update the response=] for its [=prefetch record/redirect chain=] given |request| and |response|. + 1. If |prefetchRecord|'s [=prefetch record/partition state=] is a [=cross-partition prefetch state=]: + 1. Let |hypotheticalEnvironment| be the result of [=creating a reserved client=] given |navigable|, |currentURL|, and null. + 1. Let |hypotheticalPartitionKey| be the result of [=determining the network partition key=] given |hypotheticalEnvironment|. + 1. Let |hasConflictingCredentials| be true if there are [=credentials=] associated with |currentURL| and |hypotheticalPartitionKey|, and false otherwise. + 1. If |hasConflictingCredentials| is true: + 1. Let |loadingModes| be the result of [=getting the supported loading modes=] for |response|. + 1. If |loadingModes| does not [=list/contain=] \`uncredentialed-prefetch\` then [=set/append=] |currentURL|'s [=url/origin=] to |prefetchRecord|'s [=prefetch record/partition state=]'s [=cross-partition prefetch state/origins with conflicting credentials=]. 1. Set |locationURL| to |response|'s [=response/location URL=] given |currentURL|'s [=url/fragment=]. 1. If |locationURL| is failure or null, then [=iteration/break=]. 1. [=Assert=]: |locationURL| is a [=URL=]. @@ -618,8 +625,7 @@ The list of sufficiently strict speculative navigation referrer policiesThis means that if any origin along the redirect chain had credentials, the prefetch is discarded. This reduces the chance of the user observing a logged-out page when they are logged in. -
Update this to include the `` `Supports-Loading-Mode` `` mechanism to allow responses to continue despite cookies.
+
This means that if any origin along the redirect chain had credentials (and did not override this behavior using [:Supports-Loading-Mode:]), the prefetch is discarded. This reduces the chance of the user observing a logged-out page when they are logged in.
1. [=Queue a global task=] on the [=networking task source=], given |global|, to: 1. If |navigationParams| is not a [=navigation params=], then [=prefetch record/cancel and discard=] |prefetchRecord| given |document| and abort these steps. 1. [=Assert=]: |navigationParams|'s [=navigation params/response=] is the [=exchange record/response=] of |prefetchRecord|'s [=prefetch record/redirect chain=]'s last element. diff --git a/prerendering.bs b/prerendering.bs index df69852..7baeed4 100644 --- a/prerendering.bs +++ b/prerendering.bs @@ -535,17 +535,19 @@ This stores which client hints each origin has opted into receiving, until it ca 1. Otherwise, [=map/set=] [=Accept-CH cache=][|origin|] to |hintSet|. -

The \`Supports-Loading-Mode\` HTTP response header

+

The \`Supports-Loading-Mode\` HTTP response header

The following section would be added as a sub-section of [[HTML]]'s Loading web pages section. -In some cases, cross-origin web pages might not be prepared to be loaded in a novel context. To allow them to opt in to being loaded in such ways, the \`Supports-Loading-Mode\` HTTP response header can be used. This header is a [=structured header=]; if present its value must be the single [=structured header/token=] \`credentialed-prerender\`. +In some cases, cross-origin web pages might not be prepared to be loaded in a novel context. To allow them to opt in to being loaded in such ways, the \`Supports-Loading-Mode\` HTTP response header can be used. This header is a [=structured header=]; if present its value must be one or more of the [=structured header/tokens=] listed below. -

The parsing is actually done as a [=structured header/list=] of [=structured header/tokens=], and unknown tokens will be ignored. However, authors are best off avoiding any form except the single-token one, for future compatibility. +

The parsing is actually done as a [=structured header/list=] of [=structured header/tokens=], and unknown tokens will be ignored. -The \`credentialed-prerender\` token indicates that the response can be used to create a [=prerendering navigable=], despite the prerendering being initiated by a cross-origin same-site referrer. Without this opt-in, such prerenders will fail, as outlined in [[#navigate-fetch-patch]]. +The \`credentialed-prerender\` token indicates that the response can be used to create a [=prerendering navigable=], despite the prerendering being initiated by a cross-origin same-site referrer. Without this opt-in, such prerenders will fail, as outlined in [[#navigate-fetch-patch]]. -To get the supported loading modes for a [=response=] |response|: +The \`uncredentialed-prefetch\` token indicates that the response is suitable to use even if a top-level navigation to this URL would ordinarily send [=credentials=] such as cookies. For instance, the response may be identical or it may be semantically equivalent (e.g., an HTML resource containing script which can update the document after navigation, when local user state is available). + +To get the supported loading modes for a [=response=] |response|: 1. If |response| is a [=network error=], then return an empty list.