From b36454f50484ba5b17633e43b93c054ce3f31814 Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Tue, 9 Oct 2018 22:38:11 +0200
Subject: [PATCH] Change how module scripts are fetched

* Module scripts are always fetched with request credentials mode
  "same-origin" by default, instead of the previous default of "omit".
  Only worker module scripts can still set that to "omit", using the
  credentials option to the Worker constructor. Non-worker module
  scripts, which only have the crossorigin="" attribute available, can
  only toggle between "same-origin" and "include", similar to how
  crossorigin="" works for other platform features.
* Similarly, import() statements inside of classic scripts now use the
  "same-origin" credentials mode, instead of "omit". This affects both
  <script> elements, where the default can be changed using
  crossorigin="", and other contexts like javascript: URLs and classic
  worker scripts, where the default cannot be changed.
* The top-level script for module workers is always fetched with request
  mode "same-origin". Cross-origin workers did not quite work due to
  service workers.

Fixes #2557. Fixes #3109.

Tests:

* https://github.com/web-platform-tests/wpt/pull/11274
* https://github.com/web-platform-tests/wpt/pull/13176
* https://github.com/web-platform-tests/wpt/issues/13426
---
 source | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/source b/source
index 1cefc3c6918..49e7d3d565d 100644
--- a/source
+++ b/source
@@ -7120,8 +7120,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
 
   <dl class="switch">
    <dt><span data-x="attr-crossorigin-none">No CORS</span></dt>
-   <dd>"<code data-x="">omit</code>"</dd>
-
    <dt><span data-x="attr-crossorigin-anonymous">Anonymous</span></dt>
    <dd>"<code data-x="">same-origin</code>"</dd>
 
@@ -86707,8 +86705,9 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
   empty string, <span data-x="concept-script-fetch-options-parser">parser metadata</span> is "<code
   data-x="">not-parser-inserted</code>", <span
   data-x="concept-script-fetch-options-credentials">credentials mode</span> is "<code
-  data-x="">omit</code>", and <span data-x="concept-script-fetch-options-referrer-policy">referrer
-  policy</span> is the empty string.</p>
+  data-x="">same-origin</code>", and <span
+  data-x="concept-script-fetch-options-referrer-policy">referrer policy</span> is the empty
+  string.</p>
 
   <p>Given a <span data-x="concept-request">request</span> <var>request</var> and a <span>script
   fetch options</span> <var>options</var>, we define:</p>
@@ -87066,6 +87065,11 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
    data-x="concept-request-client">client</span> is <var>fetch client settings
    object</var>.</p></li>
 
+   <li><p>If <var>destination</var> is "<code data-x="">worker</code>" or "<code
+   data-x="">sharedworker</code>" and the <var>top-level module fetch</var> flag is set, then set
+   <var>request</var>'s <span data-x="concept-request-mode">mode</span> to "<code
+   data-x="">same-origin</code>".
+
    <li><p><span>Set up the module script request</span> given <var>request</var> and
    <var>options</var>.</p></li>
 
@@ -98240,7 +98244,7 @@ interface <dfn>Worker</dfn> : <span>EventTarget</span> {
 
 dictionary <dfn>WorkerOptions</dfn> {
   <span>WorkerType</span> type = "classic";
-  <span>RequestCredentials</span> credentials = "omit"; // credentials is only used if type is "module"
+  <span>RequestCredentials</span> credentials = "same-origin"; // credentials is only used if type is "module"
   DOMString name = "";
 };