Define preconnect and dns-prefetch with CSP

whatwg / fetch

Fetch Standard

https://fetch.spec.whatwg.org/

Other

2.12k stars 333 forks source link

Define preconnect and dns-prefetch with CSP #1620

Open noamr opened 1 year ago

noamr commented 1 year ago

Preconnect & dns-prefetch test a fake prefetch request for CSP, and then obtain a connection/resolve an origin.

See whatwg/html#9035

[ ] At least two implementers are interested (and none opposed):
- …
- …
[ ] Tests are written and can be reviewed and commented upon at:
- …
[ ] Implementation bugs are filed:
- Chromium: …
- Gecko: …
- WebKit: …
- Deno (not for CORS changes): …
[ ] MDN issue is filed: …

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

noamr commented 1 year ago

It's unfortunate these have to be separate algorithms. I was hoping we could do CSP checks as part of the normal "obtain a connection" routine.

We can do that but then there would be double CSP checks, one for the request and one for the "fake" request, or we can add a flag to obtain/resolve of whether to perform the CSP check.