A response can have an associated -location URL (null, failure, or a -URL). Unless specified otherwise, response has no -location URL. - -
This concept is used for redirect handling in Fetch and in HTML's
-navigate algorithm. It ensures `Location` has
-its value extracted consistently and only once.
-[[!HTML]]
-
A response whose @@ -2006,6 +1996,34 @@ is a filtered response whose
A stale response is a response that is not a fresh response or a stale-while-revalidate response. +
To extract a location URL, given a +response response: + +
If response's status is not a redirect status, then + return null. + +
Let location be the result of extracting header list values given
+ `Location` and response's header list.
+
+
+
If location is a value, then set location to the result + of parsing location with response's + URL. + +
If response was constructed in a service worker response's + URL will be null, meaning that location will only parse + successfully if it is an absolute-URL-with-fragment string. + +
Return location. +
Extract a location URL is used for redirect handling in Fetch and +in HTML's navigate algorithm as it handles redirects manually. [[!HTML]] +
303 is excluded as certain communities ascribe special status to it. -
Let location be the result of extracting header list values given
- `Location` and actualResponse's header list.
-
-
If location is a value, then set location to the - result of parsing location with actualResponse's - URL. - -
Set actualResponse's - location URL to location. -
Switch on request's redirect mode: @@ -4003,18 +4011,15 @@ optional CORS-preflight flag, run these steps: filtered response, and response's internal response otherwise. -
If actualResponse's location URL - is null, then return response. +
Let locationURL be the result of extracting a location URL given + actualResponse. -
If actualResponse's location URL - is failure, then return a network error. - +
If locationURL is null, then return response. -
If actualResponse's - location URL's - scheme is not an - HTTP(S) scheme, then return a - network error. +
If locationURL is failure, then return a network error. + +
If locationURL's scheme is not an HTTP(S) scheme, then + return a network error.
If request's redirect count is twenty, return a network error. @@ -4023,15 +4028,13 @@ optional CORS-preflight flag, run these steps: redirect count by one.
If request's mode is "cors",
- actualResponse's location URL
- includes credentials, and request's
- origin is not same origin with actualResponse's
- location URL's origin, then return a network error.
+ locationURL includes credentials, and request's
+ origin is not same origin with locationURL's
+ origin, then return a network error.
If request's response tainting is "cors" and
- actualResponse's location URL
- includes credentials, then return a network error.
+ locationURL includes credentials, then return a network error.
This catches a cross-origin resource redirecting to a same-origin URL. @@ -4039,11 +4042,11 @@ optional CORS-preflight flag, run these steps: body is non-null, and request's body's source is null, then return a network error. -
If actualResponse's location URL's origin is - not same origin with request's current URL's - origin and request's origin is not same origin - with request's current URL's origin, then set - request's tainted origin flag. +
If locationURL's origin is not same origin with + request's current URL's origin and + request's origin is not same origin with request's + current URL's origin, then set request's + tainted origin flag.
If one of the following is true @@ -4074,7 +4077,7 @@ optional CORS-preflight flag, run these steps:
request's body's source's nullity has already been checked. -
Append actualResponse's location URL to request's +
Invoke set request's referrer policy on redirect on request and