Sec-Fetch-User is not detailed enough

[annevk]

E.g., if I change the src of an <img> element in response to a click, does that count? What if I invoked fetch() instead? (Note that in case of the latter putting state on requests isn't the way to go.)

[mikewest]

Indeed. It's quite hand-wavy at the moment. The requests I care most about are navigational requests, and the approach sketched out in the spec assumes that we'd check the user activation status in HTML's navigation algorithm, and pass it on to Fetch.

For subresource requests, the implementation behind a flag in Chrome is currently hard-coded to ?F, as we hadn't made a decision about whether it would be useful enough on the server side to expose whether or not the user agent thought that the request was triggered by user activation. If it turns out to be useful, I expect our implementation would rely upon LocalFrame::HasTransientUserActivation, which is being reimplemented on top of https://github.com/mustaqahmed/user-activation-v2.

In the spec, I expect we'd continue to rely on triggered by user activation, but we'd need to examine it explicitly in every case where we construct a request object (as I expect it would be unreasonable to blindly apply that test from inside Fetch).

/cc @arturjanc, as we've talked about this a little bit in the past.

[arturjanc]

As a bit of a tangent: after Chrome implements Sec-Fetch-Site: none we're going to gather data about the number of cross-site navigations that don't set Sec-Fetch-User: ?T and review what causes them. Depending on how frequently this happens, we'll have an idea about the cases where it's tractable to block/redirect requests without a user-activation (to protect against some XS-Search attacks).

[mikewest]

In 79938e0, I've locked the header to navigation requests (in https://mikewest.github.io/sec-metadata/#sec-fetch-user-header), and done a little work to explain the integration between Fetch and HTML in (https://mikewest.github.io/sec-metadata/#fetch-integration).

Do those look like patches you'd consider accepting against those documents, @annevk?

[annevk]

That is probably reasonable, yes. Assuming navigate hasn't gone in parallel by the time you do the "triggered by user activation" check.

[mikewest]

Ok. Tests are being updated in https://chromium-review.googlesource.com/c/chromium/src/+/1545871 (WPT: web-platform-tests/wpt#16148). I'll close this out once that lands, and punt the subresource discussion to #26.

[mikewest]

web-platform-tests/wpt#16148 was merged over the weekend.