diff --git a/docs/index.bs b/docs/index.bs index 11561fa2..2e63c955 100644 --- a/docs/index.bs +++ b/docs/index.bs @@ -145,6 +145,7 @@ spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/ text: get a reader; url: concept-get-reader text: header; url: concept-header text: http fetch; url: concept-http-fetch + text: HTTPS state value; url: concept-https-state-value text: internal response; url: concept-internal-response text: locked; url: concept-body-locked text: navigation request @@ -187,6 +188,7 @@ spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/ text: cache state text: CORS-exposed header-name list text: header list + text: https state text: response text: status text: termination reason @@ -222,6 +224,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/ text: https state; for: environment settings object text: module script text: realm execution context + text: referrer policy; for: environment settings object; url: concept-settings-object-referrer-policy text: relevant Realm; url: concept-relevant-realm text: relevant global object; url: concept-relevant-global text: report the error @@ -243,6 +246,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/ text: web worker; url: workers for: workerglobalscope; urlPrefix: #concept-workerglobalscope- text: https state + text: referrer policy text: type text: url type: event @@ -333,7 +337,7 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/

A service worker has an associated containing service worker registration (a service worker registration), which contains itself.

A service worker has an associated id (an opaque string), which uniquely identifies itself during the lifetime of its containing service worker registration.

A service worker is dispatched a set of lifecycle events, install and activate, and functional events including fetch.

-

A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state which is "none", "deprecated", or "modern". Unless stated otherwise, it is "none".

+

A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state (an HTTPS state value). It is initially "none". A script resource has an associated referrer policy (a referrer policy). It is initially the empty string.

A service worker has an associated script resource map which is a List of the Record {\[[key]], \[[value]]} where \[[key]] is a URL and \[[value]] is a response.

A service worker has an associated skip waiting flag. Unless stated otherwise it is unset.

A service worker has an associated imported scripts updated flag. It is initially unset.

@@ -3241,6 +3245,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
  • Invoke Finish Job with job and abort these steps.
    • +
  • Let httpsState be "none".
    • +
  • Let referrerPolicy be the empty string.
  • Switching on job's worker type, run these substeps with the following options:
    "classic"
    @@ -3270,6 +3276,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list.

    See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

    • +
  • Set httpsState to response's HTTPS state.
    • +
  • Set referrerPolicy to the result of parsing the `Referrer-Policy` header of response.
  • If serviceWorkerAllowed is failure, then:
    1. Asynchronously complete these steps with a network error.
      2. @@ -3325,6 +3333,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
    2. Let worker be a new service worker.
    3. Generate a unique opaque string and set worker's id to the value.
    4. Set worker's script url to job's script url, worker's script resource to script, and worker's type to job's worker type.
      5. +
    5. Set worker's script resource's HTTPS state to httpsState.
      6. +
    6. Set worker's script resource's referrer policy to referrerPolicy.
    7. Invoke Run Service Worker algorithm with worker as the argument.
    8. If an uncaught runtime script error occurs during the above step, then:
        @@ -3517,9 +3527,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
        Return workerGlobalScope.
        The responsible event loop
        Return workerEventLoop.
        -
        The referrer source
        -
        Return serviceWorker's script url.
        -

        Remove this definition after sorting out the referencing sites.

        +
        The referrer policy
        +
        Return workerGlobalScope's referrer policy.
        The API URL character encoding
        Return UTF-8.
        The API base URL
        @@ -3534,6 +3543,7 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
      1. Set workerGlobalScope's url to serviceWorker's script url.
      2. Set workerGlobalScope's HTTPS state to serviceWorker's script resource's HTTPS state.
        3. +
      3. Set workerGlobalScope's referrer policy to serviceWorker's script resource's referrer policy.
      4. Set workerGlobalScope's type to serviceWorker's type.
      5. Create a new {{WorkerLocation}} object and associate it with workerGlobalScope.
      6. If serviceWorker is an active worker, and there are any tasks queued in serviceWorker's containing service worker registration's task queues, queue them to serviceWorker's event loop's task queues in the same order using their original task sources.
        7. diff --git a/docs/index.html b/docs/index.html index f894254f..688d3d5a 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1754,7 +1754,7 @@

        A service worker has an associated containing service worker registration (a service worker registration), which contains itself.

        A service worker has an associated id (an opaque string), which uniquely identifies itself during the lifetime of its containing service worker registration.

        A service worker is dispatched a set of lifecycle events, install and activate, and functional events including fetch.

        -

        A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state which is "none", "deprecated", or "modern". Unless stated otherwise, it is "none".

        +

        A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state (an HTTPS state value). It is initially "none". A script resource has an associated referrer policy (a referrer policy). It is initially the empty string.

        A service worker has an associated script resource map which is a List of the Record {[[key]], [[value]]} where [[key]] is a URL and [[value]] is a response.

        A service worker has an associated skip waiting flag. Unless stated otherwise it is unset.

        A service worker has an associated imported scripts updated flag. It is initially unset.

        @@ -3855,8 +3855,8 @@

        7.2. Content Security Policy

        Whenever a user agent invokes Run Service Worker algorithm with a service worker serviceWorker:

          -
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy HTTP header containing the value policy, the user agent must enforce policy for serviceWorker. -
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy-Report-Only HTTP header containing the value policy, the user agent must monitor policy for serviceWorker. +
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy HTTP header containing the value policy, the user agent must enforce policy for serviceWorker. +
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy-Report-Only HTTP header containing the value policy, the user agent must monitor policy for serviceWorker.

        The primary reason for this restriction is to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS).

        @@ -4196,6 +4196,8 @@

        UpdateInvoke Reject Job Promise with job and a TypeError.
      7. Invoke Finish Job with job and abort these steps.

      +
    9. Let httpsState be "none". +
    10. Let referrerPolicy be the empty string.
    11. Switching on job’s worker type, run these substeps with the following options:
      @@ -4228,6 +4230,8 @@

      Update Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response’s header list.

      See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

      +
    12. Set httpsState to response’s HTTPS state. +
    13. Set referrerPolicy to the result of parsing the `Referrer-Policy` header of response.
    14. If serviceWorkerAllowed is failure, then:
        @@ -4270,7 +4274,7 @@

        Update

        Else, continue the rest of these steps after the algorithm’s asynchronous completion, with script being the asynchronous completion value.

      1. - If newestWorker is not null, newestWorker’s script url equals job’s script url with the exclude fragments flag set, and script is a byte-for-byte match with newestWorker’s script resource, then: + If newestWorker is not null, newestWorker’s script url equals job’s script url with the exclude fragments flag set, and script is a byte-for-byte match with newestWorker’s script resource, then:
        1. Invoke Resolve Job Promise with job and the ServiceWorkerRegistration object which represents registration.
        2. Invoke Finish Job with job and abort these steps. @@ -4280,7 +4284,9 @@

          Update
        3. Let worker be a new service worker.
        4. Generate a unique opaque string and set worker’s id to the value. -
        5. Set worker’s script url to job’s script url, worker’s script resource to script, and worker’s type to job’s worker type. +
        6. Set worker’s script url to job’s script url, worker’s script resource to script, and worker’s type to job’s worker type. +
        7. Set worker’s script resource’s HTTPS state to httpsState. +
        8. Set worker’s script resource’s referrer policy to referrerPolicy.
        9. Invoke Run Service Worker algorithm with worker as the argument.
        10. If an uncaught runtime script error occurs during the above step, then: @@ -4442,7 +4448,7 @@

          script resource. +
        11. Let script be serviceWorker’s script resource.
        12. Assert: script is not null.
        13. If serviceWorker is already running, abort these steps.
        14. Create a separate parallel execution environment (i.e. a separate thread or process or equivalent construct), and run the rest of these steps in that context. @@ -4463,13 +4469,12 @@

          responsible event loop
          Return workerEventLoop. -
          The referrer source -
          Return serviceWorker’s script url. -

          Remove this definition after sorting out the referencing sites.

          +
          The referrer policy +
          Return workerGlobalScope’s referrer policy.
          The API URL character encoding
          Return UTF-8.
          The API base URL -
          Return serviceWorker’s script url. +
          Return serviceWorker’s script url.
          The origin
          Return its registering service worker client’s origin.
          The creation URL @@ -4477,8 +4482,9 @@

          HTTPS state
          Return workerGlobalScope’s HTTPS state.

      15. -
    15. Set workerGlobalScope’s url to serviceWorker’s script url. -
    16. Set workerGlobalScope’s HTTPS state to serviceWorker’s script resource’s HTTPS state. +
    17. Set workerGlobalScope’s url to serviceWorker’s script url. +
    18. Set workerGlobalScope’s HTTPS state to serviceWorker’s script resource’s HTTPS state. +
    19. Set workerGlobalScope’s referrer policy to serviceWorker’s script resource’s referrer policy.
    20. Set workerGlobalScope’s type to serviceWorker’s type.
    21. Create a new WorkerLocation object and associate it with workerGlobalScope.
    22. If serviceWorker is an active worker, and there are any tasks queued in serviceWorker’s containing service worker registration’s task queues, queue them to serviceWorker’s event loop’s task queues in the same order using their original task sources. @@ -5243,17 +5249,17 @@

      Appendix B: Extended HTTP headers

      Service Worker Script Request

      -

      An HTTP request to fetch a service worker’s script resource will include the following header:

      +

      An HTTP request to fetch a service worker’s script resource will include the following header:

      `Service-Worker`
      - Indicates this request is a service worker’s script resource request. + Indicates this request is a service worker’s script resource request.

      This header helps administrators log the requests and detect threats.

      Service Worker Script Response

      -

      An HTTP response to a service worker’s script resource request can include the following header:

      +

      An HTTP response to a service worker’s script resource request can include the following header:

      `Service-Worker-Allowed`
      @@ -5299,7 +5305,7 @@

      Syntax

      -

      ABNF for the values of the headers used by the service worker’s script resource requests and responses:

      +

      ABNF for the values of the headers used by the service worker’s script resource requests and responses:

      Service-Worker = %x73.63.72.69.70.74 ; "script", case-sensitive

      The validation of the Service-Worker-Allowed header’s values is done by URL parsing algorithm (in Update algorithm) instead of using ABNF.

      @@ -5598,6 +5604,7 @@

      "redundant", in §3.1
    23. redundant, in §3.1
    24. referrer, in §Unnumbered section +
    25. referrer policy, in §2.1
    26. registerForeignFetch(options), in §4.5.1
    27. registering script url, in §2.2
    28. register(scriptURL), in §3.4.3 @@ -5833,6 +5840,8 @@

      header list
    29. headers
    30. http fetch +
    31. https state +
    32. https state value
    33. initiator
    34. internal response
    35. locked @@ -5930,6 +5939,7 @@

      perform the fetch
    36. queue a task
    37. realm execution context +
    38. referrer policy
    39. relevant global object
    40. relevant realm
    41. relevant settings object @@ -6342,7 +6352,6 @@

      I

      Issues Index

      The response’s cache state concept had been removed from fetch. The fetch issue #376 tracks the request to restore the concept or add some similar way to check this state. ↵
      -
      Remove this definition after sorting out the referencing sites. ↵
      +

    • +
  • Let httpsState be "none".
    • +
  • Let referrerPolicy be the empty string.
  • Switching on job's worker type, run these substeps with the following options:
    "classic"
    @@ -2935,6 +2941,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list.

    See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

    • +
  • Set httpsState to response's HTTPS state.
    • +
  • Set referrerPolicy to the result of parsing the `Referrer-Policy` header of response.
  • If serviceWorkerAllowed is failure, then:
    1. Asynchronously complete these steps with a network error.
      2. @@ -2990,6 +2998,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
    2. Let worker be a new service worker.
    3. Generate a unique opaque string and set worker's id to the value.
    4. Set worker's script url to job's script url, worker's script resource to script, and worker's type to job's worker type.
      5. +
    5. Set worker's script resource's HTTPS state to httpsState.
      6. +
    6. Set worker's script resource's referrer policy to referrerPolicy.
    7. Invoke Run Service Worker algorithm with worker as the argument.
    8. If an uncaught runtime script error occurs during the above step, then:
        @@ -3182,9 +3192,8 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
        Return workerGlobalScope.
        The responsible event loop
        Return workerEventLoop.
        -
        The referrer source
        -
        Return serviceWorker's script url.
        -

        Remove this definition after sorting out the referencing sites.

        +
        The referrer policy
        +
        Return workerGlobalScope's referrer policy.
        The API URL character encoding
        Return UTF-8.
        The API base URL
        @@ -3199,6 +3208,7 @@ spec: webidl; urlPrefix: https://heycam.github.io/webidl/
      1. Set workerGlobalScope's url to serviceWorker's script url.
      2. Set workerGlobalScope's HTTPS state to serviceWorker's script resource's HTTPS state.
        3. +
      3. Set workerGlobalScope's referrer policy to serviceWorker's script resource's referrer policy.
      4. Set workerGlobalScope's type to serviceWorker's type.
      5. Create a new {{WorkerLocation}} object and associate it with workerGlobalScope.
      6. If serviceWorker is an active worker, and there are any tasks queued in serviceWorker's containing service worker registration's task queues, queue them to serviceWorker's event loop's task queues in the same order using their original task sources.
        7. diff --git a/docs/v1/index.html b/docs/v1/index.html index 89b8bfa7..7261c1af 100644 --- a/docs/v1/index.html +++ b/docs/v1/index.html @@ -1732,7 +1732,7 @@

        A service worker has an associated containing service worker registration (a service worker registration), which contains itself.

        A service worker has an associated id (an opaque string), which uniquely identifies itself during the lifetime of its containing service worker registration.

        A service worker is dispatched a set of lifecycle events, install and activate, and functional events including fetch.

        -

        A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state which is "none", "deprecated", or "modern". Unless stated otherwise, it is "none".

        +

        A service worker has an associated script resource (a script), which represents its own script resource. It is initially set to null. A script resource has an associated has ever been evaluated flag. It is initially unset. A script resource has an associated HTTPS state (an HTTPS state value). It is initially "none". A script resource has an associated referrer policy (a referrer policy). It is initially the empty string.

        A service worker has an associated script resource map which is a List of the Record {[[key]], [[value]]} where [[key]] is a URL and [[value]] is a response.

        A service worker has an associated skip waiting flag. Unless stated otherwise it is unset.

        A service worker has an associated imported scripts updated flag. It is initially unset.

        @@ -3585,8 +3585,8 @@

        6.2. Content Security Policy

        Whenever a user agent invokes Run Service Worker algorithm with a service worker serviceWorker:

          -
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy HTTP header containing the value policy, the user agent must enforce policy for serviceWorker. -
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy-Report-Only HTTP header containing the value policy, the user agent must monitor policy for serviceWorker. +
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy HTTP header containing the value policy, the user agent must enforce policy for serviceWorker. +
        • If serviceWorker’s script resource was delivered with a Content-Security-Policy-Report-Only HTTP header containing the value policy, the user agent must monitor policy for serviceWorker.

        The primary reason for this restriction is to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS).

        @@ -3895,6 +3895,8 @@

        UpdateInvoke Reject Job Promise with job and a TypeError.
      7. Invoke Finish Job with job and abort these steps.

      +
    9. Let httpsState be "none". +
    10. Let referrerPolicy be the empty string.
    11. Switching on job’s worker type, run these substeps with the following options:
      @@ -3927,6 +3929,8 @@

      Update Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response’s header list.

      See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

      +
    12. Set httpsState to response’s HTTPS state. +
    13. Set referrerPolicy to the result of parsing the `Referrer-Policy` header of response.
    14. If serviceWorkerAllowed is failure, then:
        @@ -3969,7 +3973,7 @@

        Update

        Else, continue the rest of these steps after the algorithm’s asynchronous completion, with script being the asynchronous completion value.

      1. - If newestWorker is not null, newestWorker’s script url equals job’s script url with the exclude fragments flag set, and script is a byte-for-byte match with newestWorker’s script resource, then: + If newestWorker is not null, newestWorker’s script url equals job’s script url with the exclude fragments flag set, and script is a byte-for-byte match with newestWorker’s script resource, then:
        1. Invoke Resolve Job Promise with job and the ServiceWorkerRegistration object which represents registration.
        2. Invoke Finish Job with job and abort these steps. @@ -3979,7 +3983,9 @@

          Update
        3. Let worker be a new service worker.
        4. Generate a unique opaque string and set worker’s id to the value. -
        5. Set worker’s script url to job’s script url, worker’s script resource to script, and worker’s type to job’s worker type. +
        6. Set worker’s script url to job’s script url, worker’s script resource to script, and worker’s type to job’s worker type. +
        7. Set worker’s script resource’s HTTPS state to httpsState. +
        8. Set worker’s script resource’s referrer policy to referrerPolicy.
        9. Invoke Run Service Worker algorithm with worker as the argument.
        10. If an uncaught runtime script error occurs during the above step, then: @@ -4141,7 +4147,7 @@

          script resource. +
        11. Let script be serviceWorker’s script resource.
        12. Assert: script is not null.
        13. If serviceWorker is already running, abort these steps.
        14. Create a separate parallel execution environment (i.e. a separate thread or process or equivalent construct), and run the rest of these steps in that context. @@ -4162,13 +4168,12 @@

          responsible event loop
          Return workerEventLoop. -
          The referrer source -
          Return serviceWorker’s script url. -

          Remove this definition after sorting out the referencing sites.

          +
          The referrer policy +
          Return workerGlobalScope’s referrer policy.
          The API URL character encoding
          Return UTF-8.
          The API base URL -
          Return serviceWorker’s script url. +
          Return serviceWorker’s script url.
          The origin
          Return its registering service worker client’s origin.
          The creation URL @@ -4176,8 +4181,9 @@

          HTTPS state
          Return workerGlobalScope’s HTTPS state.

      15. -
    15. Set workerGlobalScope’s url to serviceWorker’s script url. -
    16. Set workerGlobalScope’s HTTPS state to serviceWorker’s script resource’s HTTPS state. +
    17. Set workerGlobalScope’s url to serviceWorker’s script url. +
    18. Set workerGlobalScope’s HTTPS state to serviceWorker’s script resource’s HTTPS state. +
    19. Set workerGlobalScope’s referrer policy to serviceWorker’s script resource’s referrer policy.
    20. Set workerGlobalScope’s type to serviceWorker’s type.
    21. Create a new WorkerLocation object and associate it with workerGlobalScope.
    22. If serviceWorker is an active worker, and there are any tasks queued in serviceWorker’s containing service worker registration’s task queues, queue them to serviceWorker’s event loop’s task queues in the same order using their original task sources. @@ -4822,17 +4828,17 @@

      Appendix B: Extended HTTP headers

      Service Worker Script Request

      -

      An HTTP request to fetch a service worker’s script resource will include the following header:

      +

      An HTTP request to fetch a service worker’s script resource will include the following header:

      `Service-Worker`
      - Indicates this request is a service worker’s script resource request. + Indicates this request is a service worker’s script resource request.

      This header helps administrators log the requests and detect threats.

      Service Worker Script Response

      -

      An HTTP response to a service worker’s script resource request can include the following header:

      +

      An HTTP response to a service worker’s script resource request can include the following header:

      `Service-Worker-Allowed`
      @@ -4878,7 +4884,7 @@

      Syntax

      -

      ABNF for the values of the headers used by the service worker’s script resource requests and responses:

      +

      ABNF for the values of the headers used by the service worker’s script resource requests and responses:

      Service-Worker = %x73.63.72.69.70.74 ; "script", case-sensitive

      The validation of the Service-Worker-Allowed header’s values is done by URL parsing algorithm (in Update algorithm) instead of using ABNF.

      @@ -5152,6 +5158,7 @@

      ready promise, in §3.4
    23. "redundant", in §3.1
    24. redundant, in §3.1 +
    25. referrer policy, in §2.1
    26. registering script url, in §2.2
    27. register(scriptURL), in §3.4.3
    28. register(scriptURL, options), in §3.4.3 @@ -5348,6 +5355,8 @@

      header list
    29. headers
    30. http fetch +
    31. https state +
    32. https state value
    33. initiator
    34. locked
    35. method @@ -5434,6 +5443,7 @@

      perform the fetch
    36. queue a task
    37. realm execution context +
    38. referrer policy
    39. relevant global object
    40. relevant realm
    41. relevant settings object @@ -5800,7 +5810,6 @@

      I

      Issues Index

      The response’s cache state concept had been removed from fetch. The fetch issue #376 tracks the request to restore the concept or add some similar way to check this state. ↵
      -
      Remove this definition after sorting out the referencing sites. ↵
      +