HTTP Fetch Policy - Revision history

Annevk: /* CSP cross-origin (no preflight) allowance */

2013-03-23T19:35:39Z

CSP cross-origin (no preflight) allowance

← Older revision		Revision as of 19:35, 23 March 2013
Line 32:		Line 32:

	Headers: Also Content-Type with value application/json		Headers: Also Content-Type with value application/json

			Credentials: none (although the current draft says to include all)

	=== WebSocket cross-origin (no preflight) allowance ===		=== WebSocket cross-origin (no preflight) allowance ===

Annevk: /* Request */ add credentials

2013-03-23T19:32:55Z

Request: add credentials

← Older revision		Revision as of 19:32, 23 March 2013
Line 9:		Line 9:
	* Uppercased (so e.g. geT becomes GET): CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE, and TRACK.		* Uppercased (so e.g. geT becomes GET): CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE, and TRACK.
	* Never work: CONNECT, TRACE, and TRACK (subset of the above).		* Never work: CONNECT, TRACE, and TRACK (subset of the above).
			* Everything else works within the syntax constraints.

	Author headers: Everything but [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()] limitations.		Author headers: Everything but [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()] limitations.

	Headers: Host, Origin, ...		Headers: Host, Origin, ...

			Credentials: Cookies and HTTP authentication

	Body: No limitations		Body: No limitations
Line 33:		Line 36:

	Headers: Also Upgrade: websocket, Connection: Upgrade, Sec-WebSocket-Key, Sec-WebSocket-Protocol, Sec-WebSocket-Version		Headers: Also Upgrade: websocket, Connection: Upgrade, Sec-WebSocket-Key, Sec-WebSocket-Protocol, Sec-WebSocket-Version

			Credentials: No HTTP authentication (due to API)

	== Response ==		== Response ==

Annevk: /* General limitations */

2013-03-23T19:22:45Z

General limitations

← Older revision		Revision as of 19:22, 23 March 2013
Line 10:		Line 10:
	* Never work: CONNECT, TRACE, and TRACK (subset of the above).		* Never work: CONNECT, TRACE, and TRACK (subset of the above).

	Author headers: Everything but [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()].		Author headers: Everything but [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()] limitations.

	Headers: Host, Origin, ...		Headers: Host, Origin, ...

Annevk: add websocket

2013-03-23T19:22:24Z

add websocket

← Older revision		Revision as of 19:22, 23 March 2013
Line 10:		Line 10:
	* Never work: CONNECT, TRACE, and TRACK (subset of the above).		* Never work: CONNECT, TRACE, and TRACK (subset of the above).

	~~Headers~~: ~~Limitations as per~~ [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()].		Author headers: Everything but [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()].

			Headers: Host, Origin, ...

	Body: No limitations		Body: No limitations
Line 18:		Line 20:
	Methods: Only GET, HEAD, and POST.		Methods: Only GET, HEAD, and POST.

	~~Headers~~: Only Accept, Accept-Language, Content-Language, and Content-Type. If Content-Type, value excluding parameters must be application/x-www-form-urlencoded, multipart/form-data, or text/plain.		Author headers: Only Accept, Accept-Language, Content-Language, and Content-Type. If Content-Type, value excluding parameters must be application/x-www-form-urlencoded, multipart/form-data, or text/plain.

			=== EventSource cross-origin (no preflight) allowance ===

			Headers: Also Last-Event-ID

	=== ~~EventSource~~ cross-origin (no preflight) allowance~~(sp?)~~ ===		=== CSP cross-origin (no preflight) allowance ===

	Headers: ~~Last~~-~~Event-ID~~		Headers: Also Content-Type with value application/json

	=== ~~CSP~~ cross-origin (no preflight) allowance~~(sp?)~~ ===		=== WebSocket cross-origin (no preflight) allowance ===

	Headers: ~~Content~~-~~Type~~, ~~with value application/json~~		Headers: Also Upgrade: websocket, Connection: Upgrade, Sec-WebSocket-Key, Sec-WebSocket-Protocol, Sec-WebSocket-Version

	== Response ==		== Response ==

Annevk: Created page with "This document tries to document the platform's fetching policy for HTTP. == Request == === General limitations === Methods: * Uppercased (so e.g. geT becomes GET): CONNECT..."

2013-03-23T19:05:23Z

Created page with "This document tries to document the platform's fetching policy for HTTP. == Request == === General limitations === Methods: * Uppercased (so e.g. geT becomes GET): CONNECT..."

New page

This document tries to document the platform's fetching policy for HTTP.

== Request ==

=== General limitations ===

Methods:

* Uppercased (so e.g. geT becomes GET): CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE, and TRACK.
* Never work: CONNECT, TRACE, and TRACK (subset of the above).

Headers: Limitations as per [http://xhr.spec.whatwg.org/#dom-xmlhttprequest-setrequestheader setRequestHeader()].

Body: No limitations

=== Additional general cross-origin (no preflight) limitations ===

Methods: Only GET, HEAD, and POST.

Headers: Only Accept, Accept-Language, Content-Language, and Content-Type. If Content-Type, value excluding parameters must be application/x-www-form-urlencoded, multipart/form-data, or text/plain.

=== EventSource cross-origin (no preflight) allowance(sp?) ===

Headers: Last-Event-ID

=== CSP cross-origin (no preflight) allowance(sp?) ===

Headers: Content-Type, with value application/json

== Response ==

...

[[Category:Spec coordination]]