You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>The <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-list-append">append <var>header</var> to a <var>header list</var></a> algorithm</p>
496
+
497
+
488
498
<dddata-md="">
489
499
<p>Defined in <adata-link-type="biblio" href="#biblio-fetch">[FETCH]</a></p>
indicates that the client prefers that the server redirect from an insecure
735
+
resource representation to a secure one, and that it can successfully handle
736
+
the <code><adata-link-type="dfn" href="#upgrade_insecure_requests">upgrade-insecure-requests</a></code> directive in order to make
737
+
that redirection as seamless as possible.</p>
738
+
739
+
740
+
<p>This new preference changes the <code><adata-link-type="dfn" href="https://tools.ietf.org/html/rfc7240#section-4.2">return</a></code> ABNF defined in
741
+
<adata-link-type="dfn" href="https://tools.ietf.org/html/rfc7240#section-4.2">RFC7240 Section 4.2</a> to the following:</p>
<p>When a server encounters this preference in an HTTP request’s headers, it
749
+
SHOULD redirect the user to a secure version of the resource being requested.</p>
750
+
751
+
752
+
<p>User agent implementation details are described in step #2 of the the
753
+
<ahref="#upgrade-request">§4.1
754
+
Upgrade request to a potentially secure URL, if appropriate
755
+
</a> algorithm. Note in particular that to mitigate the risk
756
+
that this header will become a vestigial part of the platform, user agents
757
+
SHOULD omit the preference when making requests to <adata-link-type="dfn" href="https://w3c.github.io/webappsec/specs/mixedcontent/#potentially-secure-origin">potentially secure
<p>Given a <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#request">Request</a></code><var>request</var>, this algorithm will rewrite its
729
804
<codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-url">url</a></code> if the <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-client">client</a></code> from which the request originates
730
-
has opted-in to upgrades.</p>
805
+
has opted-in to upgrades. It will also inject a
806
+
<code><adata-link-type="dfn" href="#returnsecure_representation">return=secure-representation</a></code> preference for insecure
807
+
navigational requests in order to improve a server’s ability to feature-detect
808
+
a client’s upgrade capabilities.</p>
731
809
732
810
733
-
<p>We will not upgrade navigational requests, with the exception of form
734
-
submissions. Form submissions will be upgraded to mitigate the risk of data
735
-
leakage via plaintext submissions.</p>
811
+
<p>We will not upgrade cross-origin navigational requests, with the exception of
812
+
form submissions. Form submissions will be upgraded to mitigate the risk of
813
+
data leakage via plaintext submissions.</p>
736
814
737
815
738
816
<pclass="issue" id="issue-3615b173"><aclass="self-link" href="#issue-3615b173"></a>This should be called from Fetch, probably after the existing step #3.</p>
739
817
740
818
741
819
<ol>
742
820
821
+
<li>
822
+
If <var>request</var>’s <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-url">url</a></code> is <adata-link-type="dfn" href="https://w3c.github.io/webappsec/specs/mixedcontent/#potentially-secure-origin">potentially secure</a>:
823
+
return without modifying <var>request</var>.
824
+
825
+
826
+
827
+
<li>
828
+
If <var>request</var>’s <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-context-frame-type">context-frame-type</a></code> is
829
+
<code>top-level</code>, <code>nested</code>, or <code>auxiliary</code>,
830
+
then <adata-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-list-append">append</a> a header named <code>Prefer</code> with a value
831
+
of <code><adata-link-type="dfn" href="#returnsecure_representation">return=secure-representation</a></code> to
If <var>request</var>’s <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-context-frame-type">context-frame-type</a></code> is
745
838
<code>top-level</code> or <code>auxiliary</code>, then:
If <var>request</var>’s <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-url">url</a></code> is <adata-link-type="dfn" href="https://w3c.github.io/webappsec/specs/mixedcontent/#potentially-secure-origin">potentially secure</a>,
792
-
return without modifying <var>request</var>.
793
-
794
-
795
-
796
883
<li>
797
884
Let <var>upgrade state</var> be the result of executing
<pclass="note" role="note">Note: This catches requests triggered from detached <codeclass="idl"><adata-link-type="idl" href="https://fetch.spec.whatwg.org/#concept-request-client">client</a></code>s.
893
980
Not sure this is necessary, really, given the inheritance structure
894
-
defined in <ahref="#nesting">§3.2 Policy Inheritance</a>.</p>
981
+
defined in <ahref="#nesting">§3.3 Policy Inheritance</a>.</p>
<pclass="note" role="note">Note: This violation report will be triggered for the <codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/dom/#interface-document">Document</a></code> or
918
1005
<codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/workers/#worker">Worker</a></code> that triggers the request. This might or might not be the same
919
1006
<adata-link-type="dfn" href="https://w3c.github.io/webappsec/specs/content-security-policy/#protected-resource">protected resource</a> that set the
920
-
<code><adata-link-type="dfn" href="#upgrade_insecure_requests">upgrade-insecure-requests</a></code> directive, due to <ahref="#nesting">§3.2 Policy Inheritance</a>.
1007
+
<code><adata-link-type="dfn" href="#upgrade_insecure_requests">upgrade-insecure-requests</a></code> directive, due to <ahref="#nesting">§3.3 Policy Inheritance</a>.
921
1008
See <ahref="#violation-report-target">§6.2 CSP Violation Reports</a> for detail.</p>
target the <codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/dom/#interface-document">Document</a></code> or <codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/workers/#worker">Worker</a></code> that triggered the request, rather
1054
1141
than the <codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/dom/#interface-document">Document</a></code> or <codeclass="idl"><adata-link-type="idl" href="http://www.w3.org/TR/workers/#worker">Worker</a></code> on which the
1055
1142
<code><adata-link-type="dfn" href="#upgrade_insecure_requests">upgrade-insecure-requests</a></code> directive was set. Due to
1056
-
<ahref="#nesting">§3.2 Policy Inheritance</a>, the latter might be a cross-origin ancestor of the former, and
1143
+
<ahref="#nesting">§3.3 Policy Inheritance</a>, the latter might be a cross-origin ancestor of the former, and
1057
1144
sending violation reports to that set of reporting endpoints could leak data
<dd>S. Bradner. <ahref="http://www.ietf.org/rfc/rfc2119.txt">Key words for use in RFCs to Indicate Requirement Levels</a>. March 1997. Best Current Practice. URL: <ahref="http://www.ietf.org/rfc/rfc2119.txt">http://www.ietf.org/rfc/rfc2119.txt</a>
0 commit comments