You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This patch does the following to the work in whatwg#1707:
- rebase to main
- add logic for parsing and storing cookies
- point to the IETF-hosted draft cookie spec
- don't point to storage access API for has storage access, use a broken
link instead
- add a broken link to environment/ancestry
- add a broken link for the request's initiator origin plumbed in from HTML. It'll be defined here, but we need to modify HTML so we can track it in the top.
- add broken links to things that need to be added to HTML
- fix some nits (e.g. "foo" -> "<code>foo</code>")
- use [=secure context=] not scheme=https
- use SameSite=None by default. Let's punt on that for now, given the
current state of implementations and lack of clear path forward.
<p class=note>It is expected that the cookie store returns an ordered list of cookies
3349
+
<li>If |cookies| <a for="list">is empty</a>, then return.
3350
+
<li>Let |value| be the result of running <a>serialize cookies</a> given |cookies|.
3351
+
<li><a for="header list">Append</a> (`<code>Cookie</code>`, <var>value</var>) to <var>request</var>'s <a for=request>header list</a>.
3352
+
</ol>
3353
+
</div>
3354
+
3355
+
<div algorithm>
3356
+
<p>To <dfn id=parse-and-store-response-cookie-headers>parse and store response `<code>Set-Cookie</code>` headers</dfn>,
3357
+
given a <a for=/>request</a><var>request</var> and a <a for=/>response</a><var>response</var>, run these steps:
3358
+
<ol>
3359
+
<li><p>Let |allowNonHostOnlyCookieForPublicSuffix| be false.
3360
+
<li><p>Let |isSecure| be false.
3361
+
<li><p>If <var>request</var>'s <a for=request>client</a> is a <a>secure context</a>, then set |isSecure| to true.
3362
+
<li><p>Let |httpOnlyAllowed| be true.
3363
+
<p class=note>Fetch implies that the request is http-only, as opposed to document.cookie
3364
+
<li><p>Let |partitionKey| be the result of [=computing the cookie partition key=] for <var>request</var>.
3365
+
<li><p>Let |partitionedContext| be the result of [=determining the partitioned context state=] for |request|.
3366
+
<li><p>Let |sameSiteStrictOrLaxAllowed| be true if the result of [=determine the same-site mode=] for |request| is "<code>StrictOrLess</code>", and false otherwise.
3367
+
<li><p><a for=list>For each</a><var>header</var> of <var>response</var>'s <a for=response>header list</a>:
3368
+
<ol>
3369
+
<li><p>If <var>header</var>'s <a for=header>name</a> is not a <a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>`, then <a for=iteration>continue</a>.
<p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a><var>request</var>, run these steps:
3386
+
<ol>
3387
+
<li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
3388
+
<li><p>If <var>request</var>'s <a for=request>method</a> is "GET" and
3389
+
<var>request</var>'s <a for=request>destination</a> is "document", return "<code>LaxOrLess</code>".
3390
+
<li><p>If <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
3391
+
<li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>Cross-Site</code>", return "<code>UnsetOrLess</code>".
3392
+
<li><p>If <var>request</var>'s <a for=request>initiator origin</a> is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
3393
+
<li><p>Return "StrictOrLess".
3394
+
</ol>
3395
+
</div>
3396
+
3397
+
3398
+
<div algorithm>
3399
+
<p>To <dfn>compute the cookie partition key</dfn> for a given <a for=/>request</a><var>request</var>, run these steps:
3400
+
<ol>
3401
+
<li><p>Let <var>topLevelOrigin</var> be <var>request</var>'s <a for=request>client</a>'s
3402
+
<a for="environment">top-level origin</a>.
3403
+
3404
+
<li><p>Let <var>topLevelSite</var> be the result of <a lt="obtain a site">obtaining a site</a>,
3405
+
given <var>topLevelOrigin</var>.
3406
+
3407
+
<li><p>Let <var>crossSiteAncestors</var> be true if <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", false otherwise.
@@ -6288,14 +6406,7 @@ optional boolean <var>forceNewConnection</var> (default false), run these steps:
6288
6406
<li><p>Set <var>response</var>'s <a for=response>body</a> to a new <a for=/>body</a> whose
6289
6407
<a for=body>stream</a> is <var>stream</var>.
6290
6408
6291
-
<li><p tracking-vector>If <var>includeCredentials</var> is true and the user agent is not
6292
-
configured to block cookies for <var>request</var> (see
6293
-
<a href=https://httpwg.org/specs/rfc6265.html#privacy-considerations>section 7</a> of
6294
-
[[!COOKIES]]), then run the "set-cookie-string" parsing algorithm (see
6295
-
<a href=https://httpwg.org/specs/rfc6265.html#set-cookie>section 5.2</a> of [[!COOKIES]]) on the
6296
-
<a for=header>value</a> of each <a for=/>header</a> whose <a for=header>name</a> is a
6297
-
<a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>` in <var>response</var>'s
6298
-
<a for=response>header list</a>, if any, and <var>request</var>'s <a for=request>current URL</a>.
6409
+
<li><p tracking-vector>If <var>includeCredentials</var> is true, the user agent should <a>parse and store response `<code>Set-Cookie</code>` headers</a> given <var>request</var> and <var>response</var>.
0 commit comments