diff --git a/source b/source index addfb3a9d48..6bb5117c066 100644 --- a/source +++ b/source @@ -2543,6 +2543,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • `Content-Language` header
  • `Last-Modified` header
  • `Referer` header
    • +
  • `Structured headers'
    • +
  • `Structured header tokens'

    • The following terms are defined in HTTP State Management Mechanism:

    @@ -2610,6 +2612,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • url list
  • status
  • header list
    • +
  • getting a structured header
  • body
  • internal response
  • CSP list
    • @@ -4020,6 +4023,29 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • start an idle period algorithm
    • + +
    Cross-Origin Embedder Policy
    + +
    +

    The following features are defined in Cross-Origin Embedder Policy:

    + + +
    +
    @@ -8985,6 +9011,10 @@ partial interface Document { data-x="concept-document-module-map">module map, which is a module map, initially empty.

    +

    The Document has a cross-origin opener policy, which is a cross-origin + opener policy.

    +

    The DocumentOrShadowRoot interface

    DOM defines the setting up a window environment settings object given realm execution context and topLevelOrigin.

    +

  • Let coop be a new cross-origin opener policy.

    • + +

  • If creator is non-null and creator's origin is + same origin with creator's relevant settings object's + top-level origin, then set coop to creator's top-level + browsing context's active document's cross-origin opener policy.

    • +

  • Let document be a new Document, marked as an HTML document in quirks mode, whose content type is "text/html", origin is origin, active sandboxing flag set is sandboxFlags, feature policy is - feature policy, and which is both ready for post-load tasks and - completely loaded immediately.

    • + feature policy, cross-origin opener policy + is coop, and which is both ready for post-load tasks and completely + loaded immediately.

  • Ensure that document has a single child html node, which itself has two empty child nodes: a head element, and a body element.

    • @@ -76999,6 +77038,13 @@ console.assert(iframeWindow.frameElement === null); keys to agent clusters). User agents are responsible for collecting agent clusters when it is deemed that nothing can access them anymore.

    +

    A browsing context group has a cross-origin isolated boolean. It is initially false.

    + +

    The impact of cross-origin + isolated is under discussion in issue + #4734.

    +

    To create a new browsing context group, run these steps:

    @@ -77297,6 +77343,29 @@ console.assert(iframeWindow.frameElement === null);
      +
    1. +

      If current's top-level browsing context's active + document's cross-origin opener policy's + value is "same-origin" or + "same-origin-plus-COEP", then:

      + +
        +

      1. Let currentDocument be current's active + document.

        2. + +
      2. +

        If currentDocument's origin is not same origin + with currentDocument's relevant settings object's top-level + origin, then set noopener to true and name to "_blank".

        + +

        In the presence of a cross-origin opener policy, nested + documents that are cross-origin with their top-level browsing context's active document, + always set noopener to true.

        +
        3. +
      +
      2. +

    2. Set new to true.

    3. If noopener is true, then set chosen to the result @@ -79731,6 +79800,549 @@ interface BarProp { +

      Cross-origin opener policies

      + +

      Cross-origin opener policy

      + +

      A cross-origin opener policy allows a document which is navigated to in a + top-level browsing context to force the creation of a new top-level browsing + context and its group. The + cross-origin opener policy consists of:

      + +
        +

      1. A cross-origin opener policy value + (value), initially "unsafe-none".

        2. + +

      2. A string or null (reporting + endpoint), initially null.

        3. + +

      3. A cross-origin opener policy value + (report only value), initially "unsafe-none".

        4. + +

      4. A string or null (report only reporting endpoint), initially null.

        5. +
      + +

      The cross-origin opener policy value consists of the following:

      + +
      +
      "unsafe-none"
      +

      This is the (current) default and means that the document will occupy the same + top-level browsing context as its predecessor, unless that document specified a + different cross-origin opener policy.

      + +
      "same-origin-allow-popups"
      +

      This forces the creation of a new top-level browsing context for the + document, unless its predecessor specified the same cross-origin opener policy and + they are same origin.

      + +
      "same-origin"
      +

      This is equivalent to "same-origin-allow-popups". Additionally, any + auxiliary browsing context created needs to contain same origin + documents that also have the same cross-origin opener policy or it will appear + closed to the opener.

      + +
      "same-origin-plus-COEP"
      +
      +

      This is equivalent to "same-origin". Additionally, it sets the (new) + top-level browsing context's group's cross-origin isolated to true.

      + +

      "same-origin-plus-COEP" cannot be directly set via the + `Cross-Origin-Opener-Policy` header, but + results from a combination of setting both Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp together.

      +
      +
      + +

      To obtain a cross-origin opener policy from a response response and an environment + environment:

      + +
        +

      1. Let policy be a new cross-origin opener policy.

        2. + +

      2. Let securityState be the result of executing Is environment + settings object a secure context? on environment.

        3. + +

      3. If securityState is "Not Secure", then return + policy.

        4. + +

      4. Let parsedValue be the result of getting a structured header + from response's header list given + name `Cross-Origin-Opener-Policy` and type + "item".

        5. + +

      5. If parsedValue is not failure and is not null, then:

        6. +
          +
        1. +

          If parsedValue bare item is "same-origin", then:

          + +
            +

          1. Let coep be the result of obtaining a cross-origin embedder + policy from response.

            2. + +

          2. If coep's value is + "require-corp", then set policy value to "same-origin-plus-COEP".

            3. + +

          3. Else, set policy value to "same-origin".

            4. +
          +
          2. + +

        2. If parsedValue bare item is "same-origin-allow-popups", + then set policy value to "same-origin-allow-popups".

          3. + +

        3. If parsedValue's parameters["report-to"] exists and it is a string, then set reporting endpoint to + parsedValue's parameters["report-to"].

          4. +
        + +

      6. Let parsedReportOnlyValue be the result of getting a structured header + from response's header list given + name `Cross-Origin-Opener-Policy-Report-Only` + and type "item".

        7. + +

      7. If parsedReportOnlyValue is not failure and is not null, then:

        8. +
          +
        1. +

          If parsedReportOnlyValue bare item is "same-origin", then:

          + +
            +

          1. Let coep be the result of obtaining a cross-origin embedder + policy from response.

            2. + +
          2. +

            If coep's value is + "require-corp" or coep's report only value is "require-corp", then set policy report only value to "same-origin-plus-COEP".

            + +

            Report only COOP also considers report only COEP to assign the special "same-origin-plus-coep" value. This allows developers more freedom in the + order of deployment of COOP and COEP.

            +
            3. + +

          3. Else, set policy report only + value to "same-origin".

            4. +
          +
          2. + +

        2. If parsedReportOnlyValue bare item is "same-origin-allow-popups", then set policy report only value to "same-origin-allow-popups".

          3. + +

        3. If parsedReportOnlyValue's parameters["report-to"] exists and it is a string, then set report only reporting endpoint to + parsedReportOnlyValue's parameters["report-to"].

          4. +
        + +

      8. Return policy.

        9. +
      + +

      To match cross-origin opener policies, given a cross-origin opener policy value A, an + origin originA, a >cross-origin opener + policy value B, and an origin originB:

      + +
        +

      1. If A is "unsafe-none" and B is "unsafe-none", then return true.

        2. + +

      2. If A or B is "unsafe-none", then return + false.

        3. + +

      3. If A is B and originA is same origin with + originB, then return true.

        4. + +

      4. Return false.

        5. +
      + +

      Browsing context group switches

      + +

      To check if a navigation requires + a browsing context group switch, given a boolean isInitialEmptyDocument, a + sandboxing flag set sandboxFlags, two origins + activeDocumentNavigationOrigin, incumbentNavigationOrigin, and two cross-origin opener policy values + navigationCOOPValue, incumbentCOOPValue:

      + +
        +

      1. If the result of matching + incumbentCOOPValue, incumbentNavigationOrigin, + navigationCOOPValue and activeDocumentNavigationOrigin is true, return + false.

        2. + +
      2. +

        If all of the following are true:

        + +
          +

        • isInitialEmptyDocument.

          • + +

        • incumbentCOOPValue's value is "same-origin-allow-popups".

          • + +

        • navigationCOOPValue is "unsafe-none".

          • +
        + +

        then return false.

        +
        3. + +

      3. Return true.

        +
      + +

      To check if enforcing report only + COOP policies would require a browsing context group switch when navigating away from a COOP + page, given a boolean isInitialEmptyDocument, a sandboxing flag set + sandboxFlags, two origins + activeDocumentNavigationOrigin, incumbentNavigationOrigin, and three cross-origin opener policy values + navigationCOOPValue, navigationCOOPReportOnlyValue, + incumbentCOOPReportOnlyValue:

      + +
        +

      1. Let browsingContextGroupSwitchNeeded be the result of checking if the navigation requires a + browsing context group switch given isInitialEmptyDocument, + sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, navigationCOOPValue and + incumbentCOOPReportOnlyValue.

        2. + +

      2. If browsingContextGroupSwitchNeeded is false, return + false.

        3. + +
      3. +

        Let browsingContextGroupSwitchNeededReportOnly be the result of checking if the navigation requires a + browsing context group switch given isInitialEmptyDocument, + sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, navigationCOOPReportOnlyValue and + incumbentCOOPReportOnlyValue.

        + +

        Matching report only policies allows a website to specify the same report only + Cross-Origin-Opener-Policy on all its pages and not receive violation reports for navigations + between these pages.

        +
        4. + +

      4. If browsingContextGroupSwitchNeededReportOnly is false, + return false.

        5. + +

      5. Return true.

        6. +
      + +

      To check if enforcing report only + COOP policies would require a browsing context group switch when navigating to a COOP + page, given a boolean isInitialEmptyDocument, a sandboxing flag set + sandboxFlags, two origins + activeDocumentNavigationOrigin, incumbentNavigationOrigin, and three cross-origin opener policy values + navigationCOOPReportOnlyValue, incumbentCOOPValue, + incumbentCOOPReportOnlyValue:

      + +
        +

      1. Let browsingContextGroupSwitchNeeded be the result of checking if the navigation requires a + browsing context group switch given isInitialEmptyDocument, + sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, navigationCOOPReportOnlyValue and + incumbentCOOPValue.

        2. + +

      2. If browsingContextGroupSwitchNeeded is false, return + false.

        3. + +
      3. +

        Let browsingContextGroupSwitchNeededReportOnly be the result of checking if the navigation requires a + browsing context group switch given isInitialEmptyDocument, + sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, navigationCOOPReportOnlyValue and + incumbentCOOPReportOnlyValue.

        + +

        Matching report only policies allows a website to specify the same report only + Cross-Origin-Opener-Policy on all its pages and not receive violation reports for navigations + between these pages.

        +
        4. + +

      4. If browsingContextGroupSwitchNeededReportOnly is false, + return false.

        5. + +

      5. Return true.

        6. +
      + +

      To obtain a browsing context to use for a + navigation response, given a request + request, a response response, two + browsing contexts source and + browsingContext, a sandboxing flag set sandboxFlags, two origins activeDocumentNavigationOrigin, + incumbentNavigationOrigin, and a cross-origin opener policy + navigationCOOP:

      + +
        +

      1. Let incumbentCOOP be the + cross-origin opener policy of currentBrowsingContext's active + document.

        2. + +

      2. Let isInitialEmptyDocument be false. If + currentBrowsingContext's only entry in its session history is the + about:blank Document that was added when browsingContext was + created, set + isInitialEmptyDocument to true.

        3. + +
      3. +

        If navigationCOOP's report only + reporting endpoint is not null, then:

        + +
          +

        1. Let browsingContexGroupSwitchNeededReportOnly be the result of checking if enforcing report only COOP + policies would require a browsing context group switch when navigating to a COOP page, + given isInitialEmptyDocument, sandboxFlags, + activeDocumentNavigationOrigin, incumbentNavigationOrigin, + navigationCOOP's report only + value, incumbentCOOP's value, and + incumbentCOOP's report only + value.

          2. + +

        2. If browsingContexGroupSwitchNeededReportOnly is true + and browsingContext's browsing context group's browsing context + set's size is strictly greater than 1, queue a violation report for + browsing context group switch when navigating to a COOP page with + navigationCOOP's report only + reporting endpoint, navigationCOOP's report only value, "reporting", response's URL, browsingContext's active + document's URL, and request's referrer.

          3. +
        +
        4. + +
      4. +

        If incumbentCOOP's report only + reporting endpoint is not null, then:

        + +
          +

        1. Let initialNavigationURL be a new empty URL.

          2. + +

        2. If source and browsingContext are the same, set + initialNavigationURL to request's URL.

          3. + +

        3. Let browsingContexGroupSwitchNeededReportOnly be the result of checking if enforcing report only + COOP policies would require a browsing context group switch when navigating away from a COOP + page, given isInitialEmptyDocument, sandboxFlags, + activeDocumentNavigationOrigin, incumbentNavigationOrigin, + navigationCOOP's value, + navigationCOOP's report only + value, and incumbentCOOP's report only value.

          4. + +

        4. If browsingContexGroupSwitchNeededReportOnly is true + and browsingContext's browsing context group's browsing context + set's size is strictly greater than 1, Queue a violation report for + browsing context group switch when navigating away from a COOP page with + incumbentCOOP's report only + reporting endpoint, incumbentCOOP's report only value, "reporting", response's URL, browsingContext's active + document's URL, and initialNavigationURL.

          5. +
        +
        5. + +

      5. Let browsingContextGroupSwitchNeeded be the result of checking if the navigation requires a + browsing context group switch given isInitialEmptyDocument, + sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, navigationCOOP's value, and incumbentCOOP's + value.

        6. + +

      6. If browsingContextGroupSwitchNeeded is false, return + browsingContext.

        7. + +

      7. If navigationCOOP's reporting + endpoint is not null, and browsingContext's + browsing context group's browsing context set's size is strictly greater than 1, queue a violation report for browsing context group switch + when navigating to a COOP page with navigationCOOP's reporting endpoint, navigationCOOP's value, "enforce", response's + URL, browsingContext's active + document's URL, and request's referrer.

        8. + +
      8. +

        If incumbentCOOP's reporting + endpoint is not null, and browsingContext's + browsing context group's browsing context set's + size is strictly greater than 1, + then:

        + +
          +

        1. Let initialNavigationURL be a new empty URL.

          2. + +

        2. If source and browsingContext are the same, set + initialNavigationURL to request's URL.

          3. + +

        3. Queue a violation report for browsing context + group switch when navigating away from a COOP page with incumbentCOOP's reporting endpoint, incumbentCOOP's + value, "enforce", + response's URL, + browsingContext's active document's URL, and + initialNavigationURL.

          4. +
        +
        9. + +

      9. Let newBrowsingContextGroup be the result of creating a new + browsing context group.

        10. + +

      10. If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContextGroup cross-origin isolated to true.

        11. + +

      11. Let newBrowsingContext be the result of creating a new browsingContext in newBrowsingContextGroup.

        12. + +
      12. +

        If sandboxFlags is not empty, then:

        +
          +

        1. Assert navigationCOOP's value is + "unsafe-none".

          2. + +

        2. Set newBrowsingContext's sandboxing flag set to + sandboxFlags.

          3. +
        +
        13. + +
      13. +

        Discard + currentBrowsingContext.

        + +

        This does not close currentBrowsingContext's browsing context + group except if it was the sole top-level browsing context in which case it could be + collected

        +
        14. + +

      14. Return newBrowsingContext.

        15. +
      + +

      The impact of swapping browsing context groups following a navigation is not + defined. It is currently under discussion in issue 5350.

      + +

      Reporting policies

      + +

      To queue a violation report for browsing context group + switch when navigating to a COOP page given a string endpoint, a cross-origin opener policy value + COOPValue, a string disposition, a URL + navigationURL, a URL currentDocumentURL, and a + referrer referrer:

      + +

        +

      1. Let previousDocumentURL be referrer.

        2. + +

      2. If currentDocumentURL and navigationURL are + same origin, set previousDocumentURL to + currentDocumentURL.

        3. + +

      3. Set previousDocumentURL's username + to the empty string, and its password to null.

        4. + +

      4. Let serializedPreviousDocumentURL be the result of executing the URL serializer on previousDocumentURL with the + exclude fragment flag set.

        5. + +
      5. +

        Let body be a new object containing the following properties with keys:

        + +
          +

        • key: "disposition", value: disposition.

          • + +

        • key: "effective-policy", value: COOPValue.

          • + +

        • key: "navigation-uri", value: + serializedPreviousDocumentURL.

          • + +

        • key: "violation-type", value: "navigate-to-document".

          • +
        +
        6. + +

      6. Queue body as "coop" on endpoint + with navigationURL.

        7. +
      + +

      To queue a violation report for browsing context group + switch when navigating away from a COOP page given a string endpoint, a + cross-origin opener policy value COOPValue, a string + disposition, a URL navigationURL, a URL + currentDocumentURL, and a URL initialNavigationURL:

      + +

        +

      1. Let nextDocumentURL be initialNavigationURL.

        2. + +

      2. If currentDocumentURL and navigationURL are + same origin, set nextDocumentURL to + navigationURL.

        3. + +

      3. Set nextDocumentURL's username to + the empty string, and its password to null.

        4. + +

      4. Let serializedNextDocumentURL be the result of executing the URL serializer on nextDocumentURL with the + exclude fragment flag set.

        5. + +
      5. +

        Let body be a new object containing the following properties with keys:

        + +
          +

        • key: "disposition", value: disposition.

          • + +

        • key: "effective-policy", value: COOPValue.

          • + +

        • key: "navigation-uri", value: + serializedNextDocumentURL.

          • + +

        • key: "violation-type", value: "navigate-from-document".

          • +
        +
        6. + +

      6. Queue body as "coop" on endpoint + with currentDocumentURL.

        7. +
      + +

      Session history and navigation

      The session history of browsing contexts

      @@ -81841,15 +82453,15 @@ interface Location { // but see also
      an HTML MIME type
      Follow the steps given in the HTML document section - providing browsingContext, request, response, - sandboxFlags, incumbentNavigationOrigin, and + providing source, browsingContext, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      an XML MIME type that is not an explicitly supported XML MIME type
      Follow the steps given in the XML document section - providing browsingContext, type, request, response, - sandboxFlags, incumbentNavigationOrigin, and + providing source, browsingContext, type, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      a JavaScript MIME type
      @@ -81860,28 +82472,28 @@ interface Location { // but see also       text/plain      "
      "text/vtt"
      Follow the steps given in the plain text file section - providing browsingContext, type, request, response, - sandboxFlags, incumbentNavigationOrigin, and + providing source, browsingContext, type, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      "multipart/x-mixed-replace"
      Follow the steps given in the multipart/x-mixed-replace section providing - browsingContext, type, request, response, - sandboxFlags, incumbentNavigationOrigin, and + source, browsingContext, type, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      A supported image, video, or audio type
      Follow the steps given in the media section providing - browsingContext, type, request, response, - sandboxFlags, incumbentNavigationOrigin, and + source, browsingContext, type, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      A type that will use an external application to render the content in browsingContext
      Follow the steps given in the plugin section - providing browsingContext, type, request, response, - sandboxFlags, incumbentNavigationOrigin, and + providing source, browsingContext, type, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin. Once the steps have completed, return.
      @@ -82052,9 +82664,9 @@ interface Location { // but see also       type type, content type contentType, a request request, a response response, a browsing context browsingContext, a sandboxing flag set - sandboxFlags, two origins + data-x="concept-response">response response, two browsing contexts source, browsingContext, a + sandboxing flag set sandboxFlags, two origins incumbentNavigationOrigin, activeDocumentNavigationOrigin, and an optional environment reservedEnvironment:

      @@ -82086,6 +82698,45 @@ interface Location { // but see also       unsafe-none".

      4. + +
    4. +

      If browsingContext is a top-level browsing context, then:

      + +
        +

      1. Set navigationCOOP to the result of obtaining a + cross-origin opener policy given response and + reservedEnvironment.

        2. + +
      2. +

        If sandboxFlags is not empty and navigationCOOP is not "unsafe-none", then display the inline + content with an appropriate error shown to the user, with the newly created + Document object's origin set to a new opaque origin, run the environment discarding steps for reservedEnvironment, and + return.

        + +

        This results in a network error as one cannot simultaneously provide a clean + slate to a response using cross-origin opener policy and sandbox the result of navigating to + that response.

        +
        3. + +

      3. Let newBrowsingContext be the value of obtaining a browsing context for the navigation + response given request, response, source, + browsingContext, sandboxFlags, activeDocumentNavigationOrigin, + incumbentNavigationOrigin, and navigationCOOP.

        4. + +

      4. Let browsingContextSwitch be false.

        5. + +

      5. If newBrowsingContext is not equal to browsingContext, then set + browsingContextSwitch to true.

        6. + +

      6. Set browsingContext to the value of newBrowsingContext.

        7. +
      +
      5. +

    5. If browsingContext's only entry in its session history is the initial about:blank Document that was added when browsingContext was created, and @@ -82129,8 +82780,9 @@ interface Location { // but see also type is type, content type is contentType, origin is origin, feature - policy is featurePolicy, and active sandboxing flag set is - finalSandboxFlags.

      6. + policy is featurePolicy, active sandboxing flag set is + finalSandboxFlags, and cross-origin opener + policy is navigationCOOP.

    6. If request is non-null, then set document's URL to request's @@ -82334,8 +82986,8 @@ new PaymentRequest(…); // Allowed to use

      Page load processing model for HTML files

      When an HTML document is to be loaded in a browsing - context, provided browsingContext, request, response, - sandboxFlags, incumbentNavigationOrigin, and + context, provided source, browsingContext, request, + response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin, the user agent must queue a task on the networking task source to:

      @@ -82343,8 +82995,9 @@ new PaymentRequest(…); // Allowed to use

    7. Let document be the result of creating and initializing a Document object providing "html", "text/html", - request, response, browsingContext, sandboxFlags, - incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

      8. + request, response, source, browsingContext, + sandboxFlags, incumbentNavigationOrigin, and + activeDocumentNavigationOrigin.

    8. Create an HTML parser and associate it with the document. Each @@ -82377,16 +83030,17 @@ new PaymentRequest(…); // Allowed to use

      Page load processing model for XML files

      -

      When faced with displaying an XML file inline, provided browsingContext, - request, response, sandboxFlags, +

      When faced with displaying an XML file inline, provided source, + browsingContext, request, response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin, user agents must follow the requirements defined in XML and Namespaces in XML, XML Media Types, DOM, and other relevant specifications to create and initialize a Document object providing "xml", type, request, response, - browsingContext, sandboxFlags, incumbentNavigationOrigin, and - activeDocumentNavigationOrigin. It must also create and a corresponding XML - parser.

      + source, browsingContext, sandboxFlags, + incumbentNavigationOrigin, and activeDocumentNavigationOrigin. It must also + create and a corresponding XML parser.

      At the time of writing, the XML specification community had not actually yet specified how XML and the DOM interact.

      @@ -82431,15 +83085,16 @@ new PaymentRequest(…); // Allowed to use

      Page load processing model for text files

      When a plain text document is to be loaded in a browsing context, provided - browsingContext, request, response, sandboxFlags, - incumbentNavigationOrigin, and activeDocumentNavigationOrigin, the user - agent must queue a task on the networking task source to: + source, browsingContext, request, response, + sandboxFlags, incumbentNavigationOrigin, and + activeDocumentNavigationOrigin, the user agent must queue a task on the + networking task source to:

      1. Let document be the result of creating and initialize a Document object providing "html", type, request, - response, browsingContext, sandboxFlags, + response, source, browsingContext, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

      2. Create an HTML parser and associate it with the document. Act as @@ -82508,7 +83163,7 @@ new PaymentRequest(…); // Allowed to use

        Page load processing model for media

        When an image, video, or audio resource is to be loaded in a browsing context, - provided browsingContext, request, response, + provided source, browsingContext, request, response, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin, the user agent should: @@ -82516,7 +83171,7 @@ new PaymentRequest(…); // Allowed to use

      3. Let document be the result of creating and initialize a Document object providing "html", type, request, - response, browsingContext, sandboxFlags, + response, source, browsingContext, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

      4. Append an html element to document.

        5. @@ -82574,15 +83229,16 @@ new PaymentRequest(…); // Allowed to use

        Page load processing model for content that uses plugins

        When a resource that requires an external resource to be rendered is to be loaded in a - browsing context, provided browsingContext, request, - response, sandboxFlags, incumbentNavigationOrigin, and - activeDocumentNavigationOrigin, the user agent should: + browsing context, provided source, browsingContext, + request, response, sandboxFlags, + incumbentNavigationOrigin, and activeDocumentNavigationOrigin, the user + agent should:

        1. Let document be the result of creating and initialize a Document object providing "html", type, request, - response, browsingContext, sandboxFlags, + response, source, browsingContext, sandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

        2. Mark document as being a plugin document

          3. @@ -82631,10 +83287,10 @@ new PaymentRequest(…); // Allowed to use

          When the user agent is to display a user agent page inline in a browsing context, the user agent should create and initialize a Document object providing "html", "text/html", null, null, browsingContext, an empty set, null, and null, - and then either associate that Document with a custom rendering that is not rendered - using the normal Document rendering rules, or mutate that Document until - it represents the content the user agent wants to render.

          + data-x="">text/html", null, null, null, browsingContext, an empty set, null, and + null, and then either associate that Document with a custom rendering that is not + rendered using the normal Document rendering rules, or mutate that + Document until it represents the content the user agent wants to render.

          @@ -115741,6 +116397,86 @@ interface External { +

          `Cross-Origin-Opener-Policy`

          + +

          This section describes a header for registration in the Permanent Message Header Field + Registry.

          + +

          The Cross-Origin-Opener-Policy HTTP + response header field allows a server to declare an opener policy for a given document. It is a + Structured Header whose value MUST be a token. Its ABNF is:

          + +

          Cross-Origin-Opener-Policy = sh-item

          + +

          Valid Cross-Origin-Opener-Policy values include "unsafe-none", "same-origin-allow-popups" and "same-origin". These values may have a parameter specifying a string which + represents the endpoint for violation reporting.

          + +

          In order to support forward-compatibility with as-yet-unknown request types, user agents MUST + ignore this header if it contains an invalid value. Likewise, user agents MUST ignore this header if + the value cannot be parsed as a sh-token.

          + +
          +
          Header field name:
          +
          Cross-Origin-Opener-Policy
          +
          Applicable protocol:
          +
          http
          +
          Status:
          +
          standard
          +
          Author/Change controller:
          +
          WHATWG
          +
          Specification document(s):
          +
          + This document is the relevant specification. +
          +
          Related information:
          +
          None.
          +
          + + + +

          `Cross-Origin-Opener-Policy-Report-Only`

          + +

          This section describes a header for registration in the Permanent Message Header Field + Registry.

          + +

          The Cross-Origin-Opener-Policy-Report-Only + HTTP response header field allows a server to declare an opener policy for a given document. It is + a Structured Header whose value MUST be a token. Its ABNF is:

          + +

          Cross-Origin-Opener-Policy-Report-Only = sh-item

          + +

          Valid Cross-Origin-Opener-Policy-Report-Only values include "unsafe-none", "same-origin-allow-popups" and "same-origin". These values may have a parameter specifying a string which + represents the endpoint for violation reporting.

          + +

          In order to support forward-compatibility with as-yet-unknown request types, user agents MUST + ignore this header if it contains an invalid value. Likewise, user agents MUST ignore this header if + the value cannot be parsed as a sh-token.

          + +
          +
          Header field name:
          +
          Cross-Origin-Opener-Policy-Report-Only
          +
          Applicable protocol:
          +
          http
          +
          Status:
          +
          standard
          +
          Author/Change controller:
          +
          WHATWG
          +
          Specification document(s):
          +
          + This document is the relevant specification. +
          +
          Related information:
          +
          None.
          +
          +

          Index

          @@ -120269,6 +121005,9 @@ INSERT INTERFACES HERE
          [COMPUTABLE]
          (Non-normative) On computable numbers, with an application to the Entscheidungsproblem, A. Turing. In Proceedings of the London Mathematical Society, series 2, volume 42, pages 230-265. London Mathematical Society, 1937.
          +
          [COEP]
          +
          Cross-Origin Embedder Policy, M. West. WICG.
          +
          [COOKIES]
          HTTP State Management Mechanism, A. Barth. IETF.
          @@ -120441,6 +121180,7 @@ INSERT INTERFACES HERE
          Hypertext Transfer Protocol (HTTP/1.1): Range Requests, R. Fielding, Y. Lafon, J. Reschke. IETF.
          Hypertext Transfer Protocol (HTTP/1.1): Caching, R. Fielding, M. Nottingham, J. Reschke. IETF.
          Hypertext Transfer Protocol (HTTP/1.1): Authentication, R. Fielding, J. Reschke. IETF.
          +
          Structured Field Values for HTTP, M. Nottingham, Fastly, P-H. Kamp, The Varnish Cache Project. IETF.
          [INDEXEDDB]
          Indexed Database API, A. Alabbas, J. Bell. W3C.