From f798b2ca263bde70276cdaf03aab9f0b45ba80eb Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 9 Jul 2025 07:08:00 +0000 Subject: [PATCH] Introduce "override fetch". This change aims to explain how and when user agents intervene against requests in order to protect users. It introduces a few stage in Fetching, which gives user agents a clear hook after a set of prerequisite checks (MIX, CSP, etc.) are performed in Main Fetch. This was originally proposed (and is explained in a bit more detail) in https://explainers-by-googlers.github.io/script-blocking/, and the hook's details and exact positioning were informed by the discussion in https://github.com/explainers-by-googlers/script-blocking/issues/2. --- fetch.bs | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 98 insertions(+), 5 deletions(-) diff --git a/fetch.bs b/fetch.bs index 7d36f3925..889572b0a 100755 --- a/fetch.bs +++ b/fetch.bs @@ -4614,7 +4614,8 @@ steps:

  • Set request's response tainting to "basic". -

  • Return the result of running scheme fetch given fetchParams. +

  • Return the result of running override fetch given "scheme fetch", + and fetchParams.

    HTML assigns any documents and workers created from URLs whose @@ -4633,7 +4634,8 @@ steps:

  • Set request's response tainting to "opaque". -

  • Return the result of running scheme fetch given fetchParams. +

  • Return the result of running override fetch given "scheme fetch" + and fetchParams. @@ -4652,8 +4654,8 @@ steps: response tainting to "cors". -

  • Let corsWithPreflightResponse be the result of running HTTP fetch - given fetchParams and true. +

  • Let corsWithPreflightResponse be the result of running override fetch + given "HTTP fetch", fetchParams, and true.

  • If corsWithPreflightResponse is a network error, then clear cache entries using request. @@ -4668,7 +4670,8 @@ steps: response tainting to "cors". -

  • Return the result of running HTTP fetch given fetchParams. +

  • Return the result of running override fetch given "HTTP fetch" and + fetchParams. @@ -4989,6 +4992,96 @@ steps: +

    Override fetch

    + +
    +

    To override fetch, given a type (which is either +"scheme fetch" or "http fetch", a fetch params +fetchParams, and an optional boolean makeCORSPreflight (default false): + +

      +

    1. Let request be fetchParams' request. + +

    2. Let response be the result of executing Potentially override response for a + request on request. + +

    3. If response is not null, return response. + +

    4. Switch on type and run the associated step: + +

      +
      "scheme fetch" +
      +

      Set response be the result of running scheme fetch given + fetchParams. + +

      "HTTP fetch" +
      +

      Set response be the result of running HTTP fetch given + fetchParams and makeCORSPreflight. +

      + +

    5. Return response. +

    +
    + +
    +

    The potentially override response for a +request algorithm takes a request request, and returns either a +response or null. Its behavior is implementation-defined, allowing user +agents to intervene on the request by returning a response directly, or allowing the +request to proceed by returning null. + +

    By default, the algorithm has the following trivial implementation: + +

      +

    1. Return null. +

    + +
    +

    User agents will generally override this default implementation with a somewhat more complex + set of behaviors. For example, a user agent might decide that its users' safety is best preserved + by generally blocking requests to `https://unsafe.example/`, while synthesizing a shim for the + widely-used resource `https://unsafe.example/widget.js` to avoid breakage. That implementation + might look like the following: + +

      +

    1. If request's current url's host's + registrable domain is "unsafe.example": + +

        +

      1. If request's current url's path is + « "widget.js" », then: + +

          +

        1. Let body be [insert a byte sequence representing the shimmed + content here]. + +

        2. Return a new response with the following properties: + +

          +
          type +
          "cors" + +
          status +
          200
          + +
          ... +
          ... + +
          body +
          The result of getting body as a body. +
          +
        + +

      2. Return a network error. +

      +

    2. Return null. +

    +
    +
    + +

    Scheme fetch