diff --git a/fetch.bs b/fetch.bs index a076992fd..d9ea05a9f 100644 --- a/fetch.bs +++ b/fetch.bs @@ -3165,23 +3165,30 @@ response header can be used to require checking a request< Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-origin" ; case-sensitive -

To perform a cross-origin resource policy check, given a request and -response, run these steps:

+

To perform a cross-origin resource policy internal check, given a string +embedder policy value, a request request and +a response response, run these steps:

    -

  1. If request's mode is not "no-cors", then return - allowed. +

  2. Assert: request's mode is "navigate" or + "no-cors".

  3. -

    If request's origin is same origin with - request's current URL's origin, then return - allowed. +

    If request's mode is "navigate": -

    While redirects that carry a - `Cross-Origin-Resource-Policy` header are checked, redirects - without such a header resulting in response do not affect the outcome as the default is - allowed. - +

    Only HTML's navigate algorithm uses this check for the + "navigate" mode, for nested navigations. [[!HTML]] + +

      +
    1. +

      Assert: request is for a nested navigation. + +

      Fix this assertion when + #948 is merged. + +

    2. If embedder policy value is "unsafe-none", then return + allowed. +

  4. Let policy be the result of getting @@ -3189,34 +3196,113 @@ Cross-Origin-Resource-Policy = %s"same-origin" / %s"same-site" / %s"cross-or header list.

    This means that `Cross-Origin-Resource-Policy: same-site, same-origin` - ends up as allowed below as it will never match anything. Two or more + ends up as allowed below as it will never match anything, as long as + embedder policy value is "unsafe-none". Two or more `Cross-Origin-Resource-Policy` headers will have the same effect. -

  5. If policy is `same-origin`, then return blocked. +

  6. If policy is null and embedder policy value is + "require-corp", then set policy to "same-origin".

  7. -

    If the following are true +

    Switch on policy: -

    +
    +
    null +
    "cross-origin" +

    Return allowed. -

    then return allowed. +

    "same-origin" +
    +

    If request's origin is same origin with + request's current URL's origin, then return + allowed. -

    This prevents HTTPS responses with - `Cross-Origin-Resource-Policy: same-site` from being accessed without secure - transport. +

    Otherwise, return blocked. -

  8. If policy is `same-site`, then return blocked. +

    "same-site" +
    +

    If the following are true -

  9. Return allowed. +

    + +

    then return allowed. + +

    Otherwise, return blocked. + +

    `Cross-Origin-Resource-Policy: same-site` does not consider a + response delivered via a secure transport to match a non-secure requesting origin, + even if their hosts are otherwise same site. Securely-transported responses will only + match a securely-transported initiator. +

    10. +
+ +

To queue a cross-origin embedder policy CORP violation report, given a request +request and a string reporting endpoint, run these steps: + +

    +

  1. Let serialized url be the result of + serializing a request URL for reporting with + request. + +

  2. +

    Let body be a new object containing the following properties: + + + + + + + + + + +
    key + value +
    "type" + "corp" +
    "blocked-url" + serialized url +
    + +

  3. Queue body as + "coep" for reporting endpoint on request's + client. [[!REPORTING]]

+

To perform a cross-origin resource policy check, given a request +request and a response response, run these steps:

+
    +

  1. Let embedder policy be request's client's + embedder policy. + +

  2. +

    If the cross-origin resource policy internal check with "unsafe-none", + request and response returns blocked, then return blocked. + +

    This is to queue only COEP related violation reports. + +

  3. If the cross-origin resource policy internal check with embedder policy's + report only value, request and response returns blocked, then + queue a cross-origin embedder policy CORP violation report with + request and embedder policy's report only reporting endpoint. + +

  4. If the cross-origin resource policy internal check with + embedder policy's value, request and response returns + allowed, then return allowed. + +

  5. Queue a cross-origin embedder policy CORP violation report with request + and embedder policy's reporting endpoint. + +

  6. Return blocked. +

Fetching

@@ -3913,6 +3999,10 @@ optional CORS-preflight flag, run these steps:
  • request's redirect mode is not "follow" and response's URL list has more than one item. + +

  • request's response tainting is "opaque" and + the cross-origin resource policy check with request and response + returns blocked.

    then return a network error. @@ -4533,7 +4623,7 @@ Range Requests. [[HTTP-RANGE]] However, this is not widely supported by b

  • If httpRequest's header list contains `Range`, then set response's range-requested flag. -

  • If httpRequest's response tainting is not "cors" +

  • If httpRequest's response tainting is "opaque" and the cross-origin resource policy check with request and response returns blocked, then return a network error.