A user account is required in order to edit this wiki, but we've had to disable public user registrations due to spam.

To request an account, ask an autoconfirmed user on IRC (such as one of these permanent autoconfirmed members) or send an e-mail to admin@wiki.whatwg.org with your desired username and an explanation of the first edit you'd like to make. (Do not use this e-mail address for any other inquiries, as they will be ignored or politely declined.)

HTTP Fetch Policy

From WHATWG Wiki
Jump to: navigation, search

This document tries to document the platform's fetching policy for HTTP.

Request

General limitations

Methods:

  • Uppercased (so e.g. geT becomes GET): CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE, and TRACK.
  • Never work: CONNECT, TRACE, and TRACK (subset of the above).
  • Everything else works within the syntax constraints.

Author headers: Everything but setRequestHeader() limitations.

Headers: Host, Origin, ...

Credentials: Cookies and HTTP authentication

Body: No limitations

Additional general cross-origin (no preflight) limitations

Methods: Only GET, HEAD, and POST.

Author headers: Only Accept, Accept-Language, Content-Language, and Content-Type. If Content-Type, value excluding parameters must be application/x-www-form-urlencoded, multipart/form-data, or text/plain.

EventSource cross-origin (no preflight) allowance

Headers: Also Last-Event-ID

CSP cross-origin (no preflight) allowance

Headers: Also Content-Type with value application/json

Credentials: none (although the current draft says to include all)

WebSocket cross-origin (no preflight) allowance

Headers: Also Upgrade: websocket, Connection: Upgrade, Sec-WebSocket-Key, Sec-WebSocket-Protocol, Sec-WebSocket-Version

Credentials: No HTTP authentication (due to API)

Response

...