Consider supporting Fetch Metadata.

[mikewest]

https://mikewest.github.io/sec-metadata/ is starting to look pretty reasonable. I plan to put up some PRs to sketch out what the integration would look like, based on the thoughts in https://mikewest.github.io/sec-metadata/#fetch-integration. I think we'd need ~3 changes, but who knows? :)

1. Add a boolean user activation flag to request objects, defaulting to false. We'd set it in HTML's navigation algorithm, based on whether the navigation was triggered by user activation.

2. Call set the Fetch Metadata headers for a request. Probably from "main fetch"?

3. Define "nested-navigate", as per Consider splitting document into document and nested-document. #755.

WDYT?

[annevk]

What's the expected interaction with service workers? Should service workers see these values exposed in two different places?

Also, if you decide to expose the headers to service workers, you can get in a situation where it appears as if the headers values are preserved, but then when the fetch is made from the service worker, the values get overridden by the fetch algorithm.

[mikewest]

I'm imagining that these headers would be set in main fetch, before we hit the service worker. I could also easily live with the headers being set in HTTP-network-or-cache fetch, after we run through the service worker.

Either way, I'm a bit confused about the expectations for fetches from Service Workers, as my mental model matches what you suggest above ("the values get overridden by the fetch algorithm"), but I've also heard suggestions that "event.respondWith(fetch(event.request)) is the same as if service worker was not there", which would mean that things like destination, et al. carry over. That's not how it works in Chrome today for things like CSP (nor, I believe, does it work that way in Firefox), so it would be helpful to get some clarity.

@jakearchibald and @arturjanc have been discussing this in more detail over the last few days, and might have thoughts to share.

[annevk]

It's not the same and cannot be. We aim for it mostly being the same (and that it never throws) so developers can use that kind of pattern safely.