diff --git a/source b/source index a3eee0bf42b..1cb22aa92c9 100644 --- a/source +++ b/source @@ -4100,8 +4100,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • container policy
  • serialized feature policy
  • default allowlist
  • -
  • The Initialize a document's feature policy algorithm
  • -
  • The Initialize a document's feature policy from a response algorithm
  • +
  • The creating a feature policy algorithm
  • +
  • The creating a feature policy from a response algorithm
  • The Is feature enabled by policy for origin algorithm
  • The Process feature policy attributes algorithm
  • @@ -78048,6 +78048,9 @@ dictionary DragEventInit : MouseEventInit { origin given browsingContext, about:blank, sandboxFlags, browsingContext's creator origin, and null. +
  • Let featurePolicy be the result of creating a feature policy + given browsingContext and origin.

  • +
  • Let realm execution context be the result of creating a new JavaScript realm with the following customizations:

    @@ -78067,7 +78070,8 @@ dictionary DragEventInit : MouseEventInit { documents">HTML document in quirks mode, whose content type is "text/html", origin is origin, active sandboxing flag set is - sandboxFlags, and which is both ready for post-load tasks and + sandboxFlags, feature policy is + feature policy, and which is both ready for post-load tasks and completely loaded immediately.

  • Ensure that document has a single child html node, which itself @@ -78084,9 +78088,6 @@ dictionary DragEventInit : MouseEventInit { referrer policy to creator's referrer policy.

  • -
  • Initialize a document's feature policy given document.

  • -
  • Add document to browsingContext's session history.

  • @@ -83669,6 +83670,24 @@ interface Location { // but see also

    + +
    +

    The creating a feature policy from a response algorithm makes use of + origin. If document.domain has been used + for the browsing context container's node document, then its + origin cannot be same origin-domain with >origin, because + these steps run before the document is created, so it cannot itself yet have used + document.domain. Note that this means that Feature + Policy checks are less permissive compared to doing a same origin check instead.

    + +

    See below for some examples of this in action.

    +
    + +
  • If browsingContext's only entry in its session history is the about:blank Document that was added when browsingContext was created, and navigation is occurring with @@ -83699,7 +83718,8 @@ interface Location { // but see also type is type, content type is contentType, - origin is origin, and active sandboxing flag set is + origin is origin, feature + policy is featurePolicy, and active sandboxing flag set is sandboxFlags.

  • If request is non-null, then set @@ -83734,24 +83754,6 @@ interface Location { // but see also no-referrer" at this point.

  • -
  • -

    Initialize a document's feature policy from a response given - document and response.

    - -
    -

    The initialize a document's feature policy from a response algorithm makes use - of document's origin. If document.domain has been used for the browsing - context container's node document, then its origin cannot be - same origin-domain with document's origin, because these - steps run when document is initialized, so it cannot itself yet have used document.domain. Note that this means that Feature Policy - checks are less permissive compared to doing a same origin check instead.

    - -

    See below for some examples of this in action.

    -
    -
  • -
  • If response has a `Refresh` header, then: