-
Notifications
You must be signed in to change notification settings - Fork 331
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Check Feature Policy before attaching Client Hints #811
Conversation
policy-controlled feature</a>, returns <code>true</code>, the user agent should | ||
<a for="header list">append</a> <var>hintName</var>/<var>value</var> to <var>request</var>'s | ||
<a for=request>header list</a>. | ||
[[!FEATURE-POLICY]] [[!CLIENT-HINTS]] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some existing plumbing that we need to refactor:
- https://fetch.spec.whatwg.org/#client-hints-list
- Fetching steps 6+7: https://fetch.spec.whatwg.org/#fetching
I think the behavior we want here is..
- We need to define the Accept-CH opt-in processing in HTML spec
- For nav request, update Fetch to reference (1) instead of current "client hints tokens" ref to IETF spec
- For subresources, execute algorithm defined in FP, checking for delegation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(1) and (2) are implemented (but not yet landed) in whatwg/html#3774 and #773
@eeeps & @tarunban - maybe we should merge all the different CH related PRs, to make it easier to discuss them in a holistic manner. Thoughts?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I'd much prefer we don't add feature policy until the architecture is more correctly described.
I agree that it's best to merge related PRs. However, I really do not have a pending PR. So, I am not sure if I can help much here. |
Closing, as I've moved this PR at over to yoavweiss#1 in order to consolidate CH/Fetch work. |
This PR is part of an attempt to address w3c/webappsec-permissions-policy#129 – using Feature Policy to let authors opt-into sending specific Client Hints to specific origins.
The overall, basic idea is:
Preview | Diff