search

w3c / webappsec-fetch-metadata

Fetch Metadata
https://w3c.github.io/webappsec-fetch-metadata/
Other
75 stars 28 forks source link

Add considerations for extension contexts. #76

Closed mikewest closed 3 years ago

mikewest commented 3 years ago

Mostly swiped this text from @iVanlIsh and @arturjanc's conversation in #47.

Closes #47 and #12.

mikewest commented 3 years ago

@arturjanc @iVanlIsh @annevk: Would y'all mind taking a look at this?

mikewest commented 3 years ago

This largely seems okay, except that I don't think this should be the place to start with normative statements around extensions. Encouraging user agents to align along these lines seems okay.

I was trying to walk that line with words like "it would be ideal" and "user agents are encouraged to implement". What struck you as overly prescriptive?

annevk commented 3 years ago

All the RFC 2119 terminology. See the last paragraph of https://infra.spec.whatwg.org/#conformance for replacements. 😊

mikewest commented 3 years ago

I've replaced RFC2119 words with non-normative alternatives, and resisted the urge to dive into 6919 too deeply. WDYT?

arturjanc commented 3 years ago

I took a quick glance at the change and it looks reasonable overall (thanks, @mikewest!)

Ideally, we would be a little more forceful and tell implementers that behaviors such as always sending the Origin header on extension-initiated requests are important to ensure that sites which use Fetch Metadata headers don't break extensions. But I don't know how to do this non-normatively so ¯\(ツ)/¯