Fetch - Revision history

Annevk: /* Pseudo-code */ this is no longer accurate, but lets keep it in sync for now until the HTML is up

2013-03-01T12:31:33Z

Pseudo-code: this is no longer accurate, but lets keep it in sync for now until the HTML is up

Annevk: /* Pseudo-code */

2013-02-27T12:53:39Z

Pseudo-code

← Older revision		Revision as of 12:53, 27 February 2013
Line 105:		Line 105:

	== Pseudo-code ==		== Pseudo-code ==

			// "No CORS" means no Origin header, no CORS checking, mark as "cross-origin", unless
			// no_tainting is defined, in which case NetworkError()
			// "Anonymous" means omit_credentials, normal CORS stuff; should probably mean no
			// Referer and globally unique identifier for Origin
			// "Use Credentials" means normal CORS stuff

	class Request:		class Request:
Line 119:		Line 125:
	force_preflight // CORS prefligth required		force_preflight // CORS prefligth required
	force_same_origin // HTML uses this for XMLDocument.load() and Workers		force_same_origin // HTML uses this for XMLDocument.load() and Workers
			cors // True / False for now
	omit_credentials // set to True to omit cookies for cross-origin requests (HTTP authentication?)		omit_credentials // set to True to omit cookies for cross-origin requests (HTTP authentication?)
	no_tainting // set to True to terminate in a "network_error" when tainted is set		no_tainting // set to True to terminate in a "network_error" when tainted is set
	// XMLHttpRequest wants this, <track> too apparently		// XMLHttpRequest wants this, <track> too apparently


	class Response:		class Response:
	state // "~~fetching~~", "headers", "loading", "done"		state // "", "headers", "loading", "done"
	type // "", "redirect", "network_error", "abort_error", "response"		type // "", "redirect", "network_error", "abort_error", "response"
	location // if type == "redirect", a URL, None otherwise		location // if type == "redirect", a URL, None otherwise
Line 138:		Line 144:
	class NetworkError(Response):		class NetworkError(Response):
	... state is "done", type is "network_error"		... state is "done", type is "network_error"

	~~def taint(response):~~
	~~response.cors = "cross-origin"~~
	~~return response~~

	def fetch(request):		def fetch(request):
	url = request.url		url = request.url
	origin = request.origin		origin = request.origin
	if url.scheme in ("about", "blob", "data"):		if url.origin == origin or url.scheme in ("about", "blob", "data"):
	return ~~basic_fetch~~(request)		return redirect_fetch(request)
	elif ~~url~~.~~origin == origin~~:		elif request.force_same_origin or (not request.cors and request.no_tainting):
	return ~~same_origin_fetch~~(request)		return NetworkError()
	elif ~~request~~.~~force_same_origin~~		elif not request.cors:
			return taint(redirect_fetch(request)) // url.scheme == "file" end up here
			elif url.scheme not in ("http", "https"):
	return NetworkError()		return NetworkError()
	~~elif url.scheme == "file":~~
	~~... implementation specific~~
	~~elif url.scheme == "ftp":~~
	~~return taint(basic_fetch(request))~~
	elif not requires_cors_with_preflight(request):		elif not requires_cors_with_preflight(request):
	return ~~potential_cors_fetch~~(request)		return cors_fetch(request)
	else:		else:
	return cors_fetch_with_preflight(request)		return cors_fetch_with_preflight(request)
Line 181:		Line 181:
	return NetworkError()		return NetworkError()

	def ~~same_origin_fetch~~ (request):		def redirect_fetch(request):
	response = basic_fetch(request)		response = basic_fetch(request)
	response.wait_for_headers() // design something better		response.wait_for_headers() // design something better
Line 187:		Line 187:
	request.url = response.location		request.url = response.location
	return fetch(request)		return fetch(request)
			elif response.type == "redirect":
			request.url = response.location
			return same_origin_fetch(request)
			else:
			return response

			def taint(response):
			response.cors = "cross-origin"
	return response		return response

Line 203:		Line 211:
	...		...

	def ~~potential_cors_fetch~~(request):		def cors_fetch(request):
	response = basic_fetch(request)		response = basic_fetch(request)
	response.wait_for_headers()		response.wait_for_headers()
Line 211:		Line 219:
	request.url = response.location		request.url = response.location
	if request.url.username or request.url.password or not cors_check(response):		if request.url.username or request.url.password or not cors_check(response):
	~~request.tainted = True~~		response.type = "network_error"
	~~if request.no_tainting:~~		return response
	response.type = "network_error"		return cors_fetch(request)
	return response
	return ~~potential_cors_fetch~~(request)
	// XXX should this succeed for about: / blob: data: (think redirects)		// XXX should this succeed for about: / blob: data: (think redirects)
	~~if not request~~.~~tainted~~ and cors_check(response):		elif response.type == "response" and not cors_check(response):
	response.~~cors~~ = "~~same-origin"~~		response.type = "network_error
	return response		return response

Line 226:		Line 232:
	response = basic_fetch(request)		response = basic_fetch(request)
	response.wait_for_headers()		response.wait_for_headers()
	if response.type in ("redirect", "network_error"):		if response.type in ("redirect", "network_error") or (response.type == "response" and not cors_check(response)):
	clear_cors_preflight_cache(request)		clear_cors_preflight_cache(request)
	response.type = "network_error"		response.type = "network_error"
	~~return response~~		return response
	~~elif response.type == "abort_error":~~
	~~return response~~
	~~if cors_check(response):~~
	~~return response~~
	~~else:~~
	~~clear_cors_preflight_cache(request)~~
	~~response.type = "network_error"~~
	return response

	def in_cors_preflight_cache(request):		def in_cors_preflight_cache(request):

Annevk: /* Pseudo-code */ add request flags

2013-02-25T17:22:45Z

Pseudo-code: add request flags

← Older revision		Revision as of 17:22, 25 February 2013
Line 117:		Line 117:
	tainted // during redirects the request can get tainted meaning		tainted // during redirects the request can get tainted meaning
	// eventual Response.cors must be "cross-origin"		// eventual Response.cors must be "cross-origin"
			force_preflight // CORS prefligth required
			force_same_origin // HTML uses this for XMLDocument.load() and Workers
			omit_credentials // set to True to omit cookies for cross-origin requests (HTTP authentication?)
			no_tainting // set to True to terminate in a "network_error" when tainted is set
			// XMLHttpRequest wants this, <track> too apparently


	class Response:		class Response:
	state // "fetching", "headers", "loading", "done"		state // "fetching", "headers", "loading", "done"
	type // "redirect", "network_error", "abort_error"~~; maybe merge this with state~~		type // "", "redirect", "network_error", "abort_error", "response"
	location // if type == "redirect", a URL, None otherwise		location // if type == "redirect", a URL, None otherwise
			redirect_count // to prevent loops just terminate when this is 10 or so
	status_code		status_code
	status_text		status_text
Line 128:		Line 135:
	entity_body		entity_body
	cors // "same-origin" or "cross-origin"		cors // "same-origin" or "cross-origin"

			class NetworkError(Response):
			... state is "done", type is "network_error"

	def taint(response):		def taint(response):
Line 140:		Line 150:
	elif url.origin == origin:		elif url.origin == origin:
	return same_origin_fetch(request)		return same_origin_fetch(request)
			elif request.force_same_origin
			return NetworkError()
	elif url.scheme == "file":		elif url.scheme == "file":
	~~return ImplementationSpecific()~~		... implementation specific
	elif url.scheme == "ftp":		elif url.scheme == "ftp":
	return taint(basic_fetch(request))		return taint(basic_fetch(request))
Line 200:		Line 212:
	if request.url.username or request.url.password or not cors_check(response):		if request.url.username or request.url.password or not cors_check(response):
	request.tainted = True		request.tainted = True
			if request.no_tainting:
			response.type = "network_error"
			return response
	return potential_cors_fetch(request)		return potential_cors_fetch(request)
	// XXX should this succeed for about: / blob: data: (think redirects)		// XXX should this succeed for about: / blob: data: (think redirects)

Annevk: add some goals

2013-02-25T16:08:33Z

add some goals

← Older revision		Revision as of 16:08, 25 February 2013
Line 3:		Line 3:

	Fetch is [http://fetch.spec.whatwg.org/ fetch.spec.whatwg.org] and will define [http://www.whatwg.org/specs/web-apps/current-work/multipage/fetching-resources.html#fetch HTML fetch] and CORS as a set of coherent algorithms rather than the intertwined mess we have now.		Fetch is [http://fetch.spec.whatwg.org/ fetch.spec.whatwg.org] and will define [http://www.whatwg.org/specs/web-apps/current-work/multipage/fetching-resources.html#fetch HTML fetch] and CORS as a set of coherent algorithms rather than the intertwined mess we have now.

			== Goals ==

			* Centralize redirect handling
			* Centralize CORS
			* Centralize fetching and thereby consistify handling of e.g. data URLs across APIs
			* Allow resources to opt into CORS without the API asking for it (stop requiring a crossorigin attribute, remove "No CORS" mode)

	== Model ==		== Model ==

Annevk: /* Pseudo-code */

2013-02-25T12:46:39Z

Pseudo-code

← Older revision		Revision as of 12:46, 25 February 2013
Line 108:		Line 108:
	headers = [] // unholy union of author_headers and ua_headers		headers = [] // unholy union of author_headers and ua_headers
	entity_body		entity_body
			tainted // during redirects the request can get tainted meaning
	tainted // during redirects the request can get tainted meaning
	// eventual Response.cors must be "cross-origin"		// eventual Response.cors must be "cross-origin"

Line 115:		Line 114:
	state // "fetching", "headers", "loading", "done"		state // "fetching", "headers", "loading", "done"
	type // "redirect", "network_error", "abort_error"; maybe merge this with state		type // "redirect", "network_error", "abort_error"; maybe merge this with state
	location // if type == "redirect", a ~~new~~ URL		location // if type == "redirect", a URL, None otherwise
	status_code		status_code
	status_text		status_text
Line 122:		Line 121:
	entity_body		entity_body
	cors // "same-origin" or "cross-origin"		cors // "same-origin" or "cross-origin"


	def taint(response):		def taint(response):

Annevk: /* Python pseudo-code */

2013-02-25T12:23:09Z

Python pseudo-code

@@ Line 97: / Line 97: @@
 For http/https, advice to not include to much random headers, even though it'll happen to some extent anyway.
-== Python pseudo-code ==
+== Pseudo-code ==
    def taint(response):
@@ Line 114: / Line 139: @@
      elif url.scheme == "ftp":
        return taint(basic_fetch(request))
-     elif ...:
+     elif not requires_cors_with_preflight(request):
        return potential_cors_fetch(request)
      else:
@@ Line 146: / Line 171: @@
        return fetch(request)
      return response
    def potential_cors_fetch(request):
@@ Line 155: / Line 194: @@
        request.url = response.location
        if request.url.username or request.url.password or not cors_check(response):
          request.tainted = True
        return potential_cors_fetch(request)
      // XXX should this succeed for about: / blob: data: (think redirects)
      if not request.tainted and cors_check(response):
        response.cors = "same-origin"
@@ Line 163: / Line 202: @@
    def cors_fetch_with_preflight(request):
      ...

Annevk at 17:44, 24 February 2013

2013-02-24T17:44:53Z

← Older revision		Revision as of 17:44, 24 February 2013
Line 111:		Line 111:
	return same_origin_fetch(request)		return same_origin_fetch(request)
	elif url.scheme == "file":		elif url.scheme == "file":
	return ~~NetworkError~~()		return ImplementationSpecific()
	elif url.scheme == "ftp":		elif url.scheme == "ftp":
	return taint(basic_fetch(request))		return taint(basic_fetch(request))
Line 135:		Line 135:
	...		...
	elif url.scheme in ("http", "https"):		elif url.scheme in ("http", "https"):
	...		... count redirects
			else:
			return NetworkError()

	def same_origin_fetch (request):		def same_origin_fetch (request):
Line 141:		Line 143:
	response.wait_for_headers() // design something better		response.wait_for_headers() // design something better
	if response.type == "redirect" and response.location.origin != request.url.origin:		if response.type == "redirect" and response.location.origin != request.url.origin:
	~~request.redirects += 1 // I guess we should avoid loops somehow~~
	request.url = response.location		request.url = response.location
	return fetch(request)		return fetch(request)
Line 150:		Line 151:
	response.wait_for_headers()		response.wait_for_headers()
	if response.type == "redirect":		if response.type == "redirect":
	request.~~redirects +~~= 1		if request.url.origin != response.location.origin:
			request.origin = uuid()
	request.url = response.location		request.url = response.location
	if ~~response~~.~~location~~.username or ~~response~~.~~location~~.password:		if request.url.username or request.url.password or not cors_check(response):
	request.~~response_cors~~ = ~~"cross-origin"~~		request.tainted = True
	~~...~~
	return potential_cors_fetch(request)		return potential_cors_fetch(request)
	if request.~~response_cors != "cross-origin":~~		// XXX should this succeed for about: / blob: data: (think redirects)
	if cors_check(response):		if not request.tainted and cors_check(response):
	response.cors = "same-origin"		response.cors = "same-origin"
	return response		return response

Annevk: add some Python pseudo-code

2013-02-24T16:44:29Z

add some Python pseudo-code

← Older revision		Revision as of 16:44, 24 February 2013
Line 96:		Line 96:

	For http/https, advice to not include to much random headers, even though it'll happen to some extent anyway.		For http/https, advice to not include to much random headers, even though it'll happen to some extent anyway.

			== Python pseudo-code ==

			def taint(response):
			response.cors = "cross-origin"
			return response

			def fetch(request):
			url = request.url
			origin = request.origin
			if url.scheme in ("about", "blob", "data"):
			return basic_fetch(request)
			elif url.origin == origin:
			return same_origin_fetch(request)
			elif url.scheme == "file":
			return NetworkError()
			elif url.scheme == "ftp":
			return taint(basic_fetch(request))
			elif ...:
			return potential_cors_fetch(request)
			else:
			return cors_fetch_with_preflight(request)

			def basic_fetch(request):
			url = request.url
			if url.scheme == "about":
			if url.scheme_data == "blank":
			return Response({type:"text/html", encoding:"utf-8", body:""})
			else:
			return NetworkError()
			elif url.scheme == "blob":
			...
			elif url.scheme == "data":
			...
			elif url.scheme == "file":
			...
			elif url.scheme == "ftp":
			...
			elif url.scheme in ("http", "https"):
			...

			def same_origin_fetch (request):
			response = basic_fetch(request)
			response.wait_for_headers() // design something better
			if response.type == "redirect" and response.location.origin != request.url.origin:
			request.redirects += 1 // I guess we should avoid loops somehow
			request.url = response.location
			return fetch(request)
			return response

			def potential_cors_fetch(request):
			response = basic_fetch(request)
			response.wait_for_headers()
			if response.type == "redirect":
			request.redirects += 1
			request.url = response.location
			if response.location.username or response.location.password:
			request.response_cors = "cross-origin"
			...
			return potential_cors_fetch(request)
			if request.response_cors != "cross-origin":
			if cors_check(response):
			response.cors = "same-origin"
			return response

			def cors_fetch_with_preflight(request):
			...

			def cors_check(response):
			...

	[[Category:Spec coordination]]		[[Category:Spec coordination]]

Annevk: /* Fetch */

2013-02-21T18:30:12Z

Fetch

← Older revision		Revision as of 18:30, 21 February 2013
Line 76:		Line 76:
	** Include them in the request or not?		** Include them in the request or not?
	** Deal with cookies in the response (before handling redirects and such) and the storage mutex.		** Deal with cookies in the response (before handling redirects and such) and the storage mutex.
			* 304 needs to be turned into a 200 for XMLHttpRequest unless explicitly requested otherwise. We should make it clearer how that works.

	For everything else Fetch will simply defer to Basic Fetch, but Fetch will be the algorithm used by the whole platform.		For everything else Fetch will simply defer to Basic Fetch, but Fetch will be the algorithm used by the whole platform.

Annevk at 17:54, 21 February 2013

2013-02-21T17:54:50Z

← Older revision		Revision as of 17:54, 21 February 2013
Line 58:		Line 58:
	* Construct the request per the HTTP specification		* Construct the request per the HTTP specification
	* Do the request		* Do the request
	* Deal with Cookies and storage mutex
	* Expose the response.		* Expose the response.

Line 74:		Line 73:
	* Authentication (challenge request, prompt the user for certain legacy APIs)		* Authentication (challenge request, prompt the user for certain legacy APIs)
	* CORS (preflight requests, marking the response as same-origin or not)		* CORS (preflight requests, marking the response as same-origin or not)
			* Cookies
			** Include them in the request or not?
			** Deal with cookies in the response (before handling redirects and such) and the storage mutex.

	For everything else Fetch will simply defer to Basic Fetch, but Fetch will be the algorithm used by the whole platform.		For everything else Fetch will simply defer to Basic Fetch, but Fetch will be the algorithm used by the whole platform.
Line 88:		Line 90:
	* Entity body		* Entity body

	== ~~Notes~~ ==		== User agent advice ==

	~~Algorithm~~: "~~fetch~~"		For http/https, maybe give advice on proxies, e.g.: "If the user agent allows the end user to configure a proxy it should modify the request appropriately; i.e., connect to the proxy host instead of the origin server, modify the Request-Line and send Proxy-Authorization headers as specified." Though ideally HTTP does this.

	* Sets up the request. Methods, headers, ~~etc.~~		For http/https, advice to not include to much random headers, even though it'll happen to some extent anyway.
	* Then branches based on specifics.

	~~Actually fetching: "do the fetch"~~

	* Should probably branch on URL scheme first.
	* Gets the data.
	* Needs to ~~queue tasks unless suppressed (sync / CORS prefetch)~~
	* Needs to be able to automatically follow redirects (http/https only).

	[[Category:Spec coordination]]		[[Category:Spec coordination]]