Skip to content

Commit 45ddbd2

Browse files
mfalkenannevk
mfalken
authored and
annevk
committed
Create a new reserved environment for cross-origin redirects
Previously, a navigation would create a reserved environment once and use it for all redirects. This commit changes that so a new environment is created on a cross-origin redirect. We now also run CSP for each redirect. See also w3c/ServiceWorker#1316.
1 parent 18ca106 commit 45ddbd2

File tree

1 file changed

+73
-36
lines changed

1 file changed

+73
-36
lines changed

‎source

Lines changed: 73 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -2835,6 +2835,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
28352835
<li><dfn data-x="concept-request-header-list" data-x-href="https://fetch.spec.whatwg.org/#concept-request-header-list">header list</dfn></li>
28362836
<li><dfn data-x="concept-request-body" data-x-href="https://fetch.spec.whatwg.org/#concept-request-body">body</dfn></li>
28372837
<li><dfn data-x="concept-request-client" data-x-href="https://fetch.spec.whatwg.org/#concept-request-client">client</dfn></li>
2838+
<li><dfn data-x="concept-request-current-url" data-x-href="https://fetch.spec.whatwg.org/#concept-request-current-url">current URL</dfn></li>
28382839
<li><dfn data-x="concept-request-reserved-client" data-x-href="https://fetch.spec.whatwg.org/#concept-request-reserved-client">reserved client</dfn></li>
28392840
<li><dfn data-x="concept-request-replaces-client-id" data-x-href="https://fetch.spec.whatwg.org/#concept-request-replaces-client-id">replaces client id</dfn></li>
28402841
<li><dfn data-x="concept-request-initiator" data-x-href="https://fetch.spec.whatwg.org/#concept-request-initiator">initiator</dfn></li>
@@ -82092,54 +82093,90 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8209282093
data-x="concept-request-origin">origin</span> to that <span>browsing context scope
8209382094
origin</span>.</p></li>
8209482095

82096+
<li><p>Let <var>done</var> be false and <var>reservedEnvironment</var> be null.</p></li>
82097+
8209582098
<li>
82096-
<p>Create a new <span>environment</span> <var>reservedEnvironment</var>, and set its <span
82097-
data-x="concept-environment-id">id</span> to a new unique opaque string, its <span
82098-
data-x="concept-environment-creation-url">creation URL</span> to <var>request</var>'s
82099-
<span>url</span>, and its <span data-x="concept-environment-target-browsing-context">target
82100-
browsing context</span> to <var>browsingContext</var>.</p>
82099+
<p>While <var>done</var> is false:</p>
8210182100

82102-
<p class="note">The created environment's <span
82103-
data-x="concept-environment-active-service-worker">active service worker</span> is set in the
82104-
<span data-x="on-fetch-request-algorithm">handle fetch</span> algorithm during the fetch if its
82105-
<span data-x="concept-environment-creation-url">creation URL</span> matches a service worker
82106-
registration. <ref spec="SW"></p>
82107-
</li>
82101+
<ol>
82102+
<li><p>Let <var>currentURL</var> be <var>response</var>'s <span
82103+
data-x="concept-response-location-url">location URL</span>, if <var>response</var> is not null,
82104+
and <var>request</var>'s <span data-x="concept-request-current-url">current URL</span>
82105+
otherwise.</p></li>
8210882106

82109-
<li><p>Set <var>request</var>'s <span data-x="concept-request-reserved-client">reserved
82110-
client</span> to <var>reservedEnvironment</var>.</p></li>
82107+
<li>
82108+
<p>If <var>reservedEnvironment</var> is not null and <var>currentURL</var>'s
82109+
<span data-x="concept-url-origin">origin</span> is not the <span
82110+
data-x="same origin">same</span> as <var>reservedEnvironment</var>'s <span
82111+
data-x="concept-environment-creation-url">creation URL</span>'s <span
82112+
data-x="concept-url-origin">origin</span>, then:</p>
8211182113

82112-
<li>
82113-
<p>If the <span>Should navigation request of type from source in target be blocked by Content
82114-
Security Policy?</span> algorithm returns "<code data-x="">Blocked</code>" when executed upon
82115-
<var>request</var>, <var>navigationType</var>, <var>sourceBrowsingContext</var>, and
82116-
<var>browsingContext</var>, then set <var>response</var> to a network error.
82117-
<ref spec="CSP"></p>
82114+
<ol>
82115+
<li><p>Run the <span>environment discarding steps</span> for
82116+
<var>reservedEnvironment</var>.</p></li>
8211882117

82119-
<p>Otherwise:</p>
82118+
<li><p>Set <var>reservedEnvironment</var> to null.</p></li>
82119+
</ol>
82120+
</li>
8212082121

82121-
<ol>
82122-
<!--FETCH--><li><p><span data-x="concept-fetch">Fetch</span> <var>request</var>.</p></li>
82122+
<li><p>If <var>reservedEnvironment</var> is null, then set <var>reservedEnvironment</var> to a
82123+
new <span>environment</span> whose <span data-x="concept-environment-id">id</span> is a
82124+
unique opaque string and <span
82125+
data-x="concept-environment-target-browsing-context">target browsing context</span> is
82126+
<var>browsingContext</var>.</p></li>
8212382127

82124-
<li><p>Wait for the <span data-x="concept-task">task</span> on the <span>networking task
82125-
source</span> to <span>process response</span> and set <var>response</var> to the
82126-
result.</p></li>
82127-
</ol>
82128-
</li>
82128+
<li>
82129+
<p>Set <var>reservedEnvironment</var>'s <span
82130+
data-x="concept-environment-creation-url">creation URL</span> to <var>currentURL</var>.</p>
8212982131

82132+
<p class="note">The created environment's <span
82133+
data-x="concept-environment-active-service-worker">active service worker</span> is set in the
82134+
<span data-x="on-fetch-request-algorithm">Handle Fetch</span> algorithm during the fetch if
82135+
the request URL matches a service worker registration. <ref spec="SW"></p>
82136+
</li>
8213082137

82131-
<li id="navigate-redirect-step">
82132-
<p>If <var>response</var> has a <span data-x="concept-response-location-url">location URL</span>
82133-
and it is either failure or a <span>URL</span> whose <span
82134-
data-x="concept-url-scheme">scheme</span> is an <span>HTTP(S) scheme</span>, then set
82135-
<var>response</var> to the result of performing <span>HTTP-redirect fetch</span> using
82136-
<var>request</var> and <var>response</var> and then run this step again.</p>
82138+
<li><p>Set <var>request</var>'s <span data-x="concept-request-reserved-client">reserved
82139+
client</span> to <var>reservedEnvironment</var>.</p></li>
8213782140

82138-
<p class="note">Navigation handles redirects manually as navigation is the only place in the web
82139-
platform that cares for redirects to <code data-x="mailto protocol">mailto:</code> URLs and
82140-
such.</p>
82141+
<li><p>If the <span>Should navigation request of type from source in target be blocked by
82142+
Content Security Policy?</span> algorithm returns "<code data-x="">Blocked</code>" when
82143+
executed upon <var>request</var>, <var>navigationType</var>, <var>sourceBrowsingContext</var>,
82144+
and <var>browsingContext</var>, then set <var>response</var> to a <span>network error</span>
82145+
and set <var>done</var> to true. <ref spec="CSP"></p></li>
82146+
82147+
<li>
82148+
<p>Otherwise:</p>
82149+
82150+
<ol>
82151+
<li><p>If <var>response</var> is null, <!--FETCH--><span
82152+
data-x="concept-fetch">fetch</span> <var>request</var>.</p></li>
82153+
82154+
<li><p>Otherwise, perform <span>HTTP-redirect fetch</span> using
82155+
<var>request</var> and <var>response</var>.</p></li>
82156+
82157+
<li><p>Wait for the <span data-x="concept-task">task</span> on the <span>networking task
82158+
source</span> to <span>process response</span> and set <var>response</var> to the
82159+
result.</p></li>
82160+
82161+
<li>
82162+
<p>If <var>response</var> does not have a <span
82163+
data-x="concept-response-location-url">location URL</span> or the <span
82164+
data-x="concept-response-location-url">location URL</span> is not a <span>URL</span> whose
82165+
<span data-x="concept-url-scheme">scheme</span> is an <span>HTTP(S) scheme</span>,
82166+
then set <var>done</var> to true.</p>
82167+
82168+
<p class="note">Navigation handles redirects manually as navigation is the only place in
82169+
the web platform that cares for redirects to <code data-x="mailto protocol">mailto:</code>
82170+
URLs and such.</p>
82171+
</li>
82172+
</ol>
82173+
</li>
82174+
</ol>
8214182175
</li>
8214282176

82177+
<li><p>If <var>response</var>'s <span data-x="concept-response-location-url">location URL</span>
82178+
is failure, then set <var>response</var> to a <span>network error</span>.</p></li>
82179+
8214382180
<li><p>Otherwise, if <var>response</var> has a <span
8214482181
data-x="concept-response-location-url">location URL</span> that is a <span>URL</span> whose <span
8214582182
data-x="concept-url-scheme">scheme</span> is "<code data-x="">blob</code>", "<code

0 commit comments

Comments
 (0)