From e26ab8afe29e23b3a4e34dbb588c285dcf68a8dc Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 20 Apr 2018 19:07:23 +0200
Subject: [PATCH] Change how module scripts are fetched

* Module scripts are always fetched with credentials mode "same-origin" by default and can no longer
  use "omit". This makes them match other high-level platform features.
* The top-level script for module workers is always fetched with request mode "same-origin" and
  credentials mode "same-origin". Cross-origin workers did not quite work due to service workers.
* Any module worker import scripts are fetched with request credentials mode "same-origin" and this
  cannot be configured for now.

Fixes #2557 and fixes #3109.
---
 source | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/source b/source
index 6c2e8a59d32..559fa60436d 100644
--- a/source
+++ b/source
@@ -7011,8 +7011,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
 
   <dl class="switch">
    <dt><span data-x="attr-crossorigin-none">No CORS</span></dt>
-   <dd>"<code data-x="">omit</code>"</dd>
-
    <dt><span data-x="attr-crossorigin-anonymous">Anonymous</span></dt>
    <dd>"<code data-x="">same-origin</code>"</dd>
 
@@ -86581,8 +86579,9 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
   empty string, <span data-x="concept-script-fetch-options-parser">parser metadata</span> is "<code
   data-x="">not-parser-inserted</code>", <span
   data-x="concept-script-fetch-options-credentials">credentials mode</span> is "<code
-  data-x="">omit</code>", and <span data-x="concept-script-fetch-options-referrer-policy">referrer
-  policy</span> is the empty string.</p>
+  data-x="">same-origin</code>", and <span
+  data-x="concept-script-fetch-options-referrer-policy">referrer policy</span> is the empty
+  string.</p>
 
   <p>Given a <span data-x="concept-request">request</span> <var>request</var> and a <span>script
   fetch options</span> <var>options</var>, we define:</p>
@@ -86842,9 +86841,9 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
 
   <p>To <dfn data-export="" id="fetch-a-module-worker-script-tree">fetch a module worker script
   graph</dfn> given a <var>url</var>, a <var>fetch client settings object</var>, a
-  <var>destination</var>, a <var>credentials mode</var>, and a <var>module map settings
-  object</var>, run these steps. The algorithm will asynchronously complete with either null (on
-  failure) or a <span>module script</span> (on success).</p>
+  <var>destination</var>, and a <var>module map settings object</var>, run these steps. The
+  algorithm will asynchronously complete with either null (on failure) or a <span>module
+  script</span> (on success).</p>
 
   <ol>
    <li><p>Let <var>visited set</var> be « <var>url</var> ».</p></li>
@@ -86854,9 +86853,10 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
    data-x="concept-script-fetch-options-integrity">integrity metadata</span> is the empty string,
    <span data-x="concept-script-fetch-options-parser">parser metadata</span> is "<code
    data-x="">not-parser-inserted</code>", <span
-   data-x="concept-script-fetch-options-credentials">credentials mode</span> is <var>credentials
-   mode</var>, and <span data-x="concept-script-fetch-options-referrer-policy">referrer
-   policy</span> is the empty string.</p>
+   data-x="concept-script-fetch-options-credentials">credentials mode</span> is "<code
+   data-x="">same-origin</code>", and <span
+   data-x="concept-script-fetch-options-referrer-policy">referrer policy</span> is the empty
+   string.</p>
 
    <li><p>Perform the <span>internal module script graph fetching procedure</span> given
    <var>url</var>, <var>fetch client settings object</var>, <var>destination</var>,
@@ -86940,6 +86940,11 @@ interface <dfn>ApplicationCache</dfn> : <span>EventTarget</span> {
    data-x="concept-request-client">client</span> is <var>fetch client settings
    object</var>.</p></li>
 
+   <li><p>If <var>destination</var> is "<code data-x="">worker</code>" or "<code
+   data-x="">sharedworker</code>" and the <var>top-level module fetch</var> flag is set, then set
+   <var>request</var>'s <span data-x="concept-request-mode">mode</span> to "<code
+   data-x="">same-origin</code>".
+
    <li><p><span>Set up the module script request</span> given <var>request</var> and
    <var>options</var>.</p></li>
 
@@ -97274,8 +97279,7 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
 
      <dt>"<code data-x="">module</code>"</dt>
      <dd><span>Fetch a module worker script graph</span> given <var>url</var>, <var>outside
-     settings</var>, <var>destination</var>, the value of the <code data-x="">credentials</code>
-     member of <var>options</var>, and <var>inside settings</var>.</dd>
+     settings</var>, <var>destination</var>, and <var>inside settings</var>.</dd>
     </dl>
 
     <p>In both cases, to <span data-x="fetching-scripts-perform-fetch">perform the fetch</span>
@@ -97688,7 +97692,6 @@ interface <dfn>Worker</dfn> : <span>EventTarget</span> {
 
 dictionary <dfn>WorkerOptions</dfn> {
   <span>WorkerType</span> type = "classic";
-  <span>RequestCredentials</span> credentials = "omit"; // credentials is only used if type is "module"
   DOMString name = "";
 };
 
@@ -97703,9 +97706,8 @@ enum <dfn>WorkerType</dfn> { "classic", "module" };
    communication channel. <var>options</var> can be used to define the <span
    data-x="concept-WorkerGlobalScope-name">name</span> of that global environment via the <code
    data-x="">name</code> option, primarily for debugging purposes. It can also ensure this new
-   global environment supports JavaScript modules (specify <code data-x="">type: "module"</code>),
-   and if that is specified, can also be used to specify how <var>scriptURL</var> is fetched through
-   the <code data-x="">credentials</code> option.
+   global environment supports JavaScript modules (specify <code
+   data-x="">type: "module"</code>).</dd>
 
    <dt><var>worker</var> . <code subdfn data-x="dom-Worker-terminate">terminate</code>()</dt>
    <dd>Aborts <var>worker</var>'s associated global environment.</dd>
@@ -97833,9 +97835,7 @@ interface <dfn>SharedWorker</dfn> : <span>EventTarget</span> {
    represents the communication channel. <var>options</var> can be used to define the <span
    data-x="concept-WorkerGlobalScope-name">name</span> of that global environment via the <code
    data-x="">name</code> option. It can also ensure this new global environment supports JavaScript
-   modules (specify <code data-x="">type: "module"</code>), and if that is specified, can also be
-   used to specify how <var>scriptURL</var> is fetched through the <code
-   data-x="">credentials</code> option.</dd>
+   modules (specify <code data-x="">type: "module"</code>).</dd>
 
    <dt><var>sharedWorker</var> . <code subdfn data-x="dom-SharedWorker-port">port</code></dt>
    <dd>Returns <var>sharedWorker</var>'s <code>MessagePort</code> object which can be used to