Skip to content

Replace request's "window" with "traversable for user prompts" #1823

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 15, 2025
Merged

Replace request's "window" with "traversable for user prompts" #1823

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cd1da21
Replace request's "window" with "traversable for user prompts"
domenic May 9, 2025
25bf260
Respond to most review comments
domenic May 13, 2025
39c2012
Expand the clone note
domenic May 13, 2025
e485e3e
Add null check
domenic May 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
136 changes: 93 additions & 43 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1666,17 +1666,38 @@ of the <a for="environment">target browsing context</a>'s <a>active document</a>
<a>environment settings object</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-window>window</dfn>
("<code>no-window</code>", "<code>client</code>", or an
<a>environment settings object</a> whose
<a for="environment settings object">global object</a> is a
{{Window}} object). Unless stated otherwise it is
"<code>client</code>".
<dfn export for=request id=concept-request-window>traversable for user prompts</dfn>, that is
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm trying to write out "end user" where I can myself. I'm not actually sure where we are consistency-wise, but is that something we can strife for? I'm happy to document it as the term to use.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, why? It seems excessively verbose...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, it's only four additional characters. Still shorter than implementer. "Person who operates the computer" might qualify for excessively verbose. 😛

To me it sounds a bit nicer and feels more respectful.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dunno, it seems a lot of churn across the ecosystem, and causes me to wonder "what's the difference between an end user and a user"? (Or is it "end-user"?)

I don't really understand the more respectful bit either.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case it helps, after all the PRs linked in the OP land, only one spec (Permissions Policy) will actually use "traversable for user prompts", so it'd be pretty easy to change later if we do decide on a larger ecosystem movement from user -> end user.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think https://datatracker.ietf.org/doc/html/rfc8890 captures best why I'd like to make this change, though arguably you could try to define "user" in the same way.

Anyway, happy to drop this for now.

"<code>no-traversable</code>", "<code>client</code>", or a <a for=/>traversable navigable</a>.
Unless stated otherwise it is "<code>client</code>".

<div class=note>
<p>This is used to determine whether and where to show necessary UI for the request, such as
authentication prompts or client certificate dialogs.

<dl>
<dt>"<code>no-traversable</code>"
<dd>No UI is shown; usually the request fails with a <a>network error</a>.

<dt>"<code>client</code>"
<dd>This value will automatically be changed to either "<code>no-traversable</code>" or to a
<a for=/>traversable navigable</a> derived from the request's <a for=request>client</a> during
<a lt=fetch for=/>fetching</a>. This provides a convenient way for standards to not have to
explicitly set a request's <a for=request>traversable for user prompts</a>.

<dt>a <a for=/>traversable navigable</a>
<dd>The UI shown will be associated with the browser interface elements that are displaying that
<a for=/>traversable navigable</a>.
</dl>
</div>

<p class=note>The "<code>client</code>" value is changed to "<code>no-window</code>" or
<a for=/>request</a>'s <a for=request>client</a> during <a lt=fetch for=/>fetching</a>. It provides
a convenient way for standards to not have to explicitly set <a for=/>request</a>'s
<a for=request>window</a>.
<p>When displaying a user interface associated with a request in that request's
<a for=request>traversable for user prompts</a>, the user agent should update the address bar to
display something derived from the request's <a for=request>current URL</a> (and not, e.g., leave
it at its previous value, derived from the URL of the request's initiator). Additionally, the user
agent should avoid displaying content from the request's initiator in the
<a for=request>traversable for user prompts</a>, especially in the case of cross-origin requests.
Displaying a blank page behind such prompts is a good way to fulfill these requirements. Failing to
follow these guidelines can confuse users as to which origin is responsible for the prompt.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
follow these guidelines can confuse users as to which origin is responsible for the prompt.
follow these guidelines can confuse end users as to which origin is responsible for the prompt.


<p id=keep-alive-flag>A <a for=/>request</a> has an associated boolean
<dfn for=request export id=request-keepalive-flag>keepalive</dfn>. Unless stated otherwise it is
Expand Down Expand Up @@ -4334,7 +4355,9 @@ the response. [[!HTTP-CACHING]]
<li><p><var>request</var>'s <a for=request>mode</a> is "<code>same-origin</code>",
"<code>cors</code>", or "<code>no-cors</code>"

<li><p><var>request</var>'s <a for=request>window</a> is an <a>environment settings object</a>
<li><p><var>request</var>'s <a for=request>client</a> is not null, and <var>request</var>'s
<a for=request>client</a>'s <a for="environment settings object">global object</a> is a
{{Window}} object

<li><p><var>request</var>'s <a for=request>method</a> is `<code>GET</code>`

Expand All @@ -4354,7 +4377,7 @@ the response. [[!HTTP-CACHING]]
<a for="fetch params">preloaded response candidate</a> to <var>response</var>.

<li><p>Let <var>foundPreloadedResource</var> be the result of invoking
<a>consume a preloaded resource</a> for <var>request</var>'s <a for=request>window</a>, given
<a>consume a preloaded resource</a> for <var>request</var>'s <a for=request>client</a>, given
<var>request</var>'s <a for=request>URL</a>, <var>request</var>'s <a for=request>destination</a>,
<var>request</var>'s <a for=request>mode</a>, <var>request</var>'s
<a for=request>credentials mode</a>, <var>request</var>'s <a for=request>integrity metadata</a>,
Expand Down Expand Up @@ -4439,15 +4462,36 @@ the response. [[!HTTP-CACHING]]
<p>To <dfn>populate request from client</dfn> given a <a for=/>request</a> <var>request</var>:

<ol>
<li><p>If <var>request</var>'s <a for=request>window</a> is "<code>client</code>", then: set
<var>request</var>'s <a for=request>window</a> to <var>request</var>'s <a for=request>client</a>
if <var>request</var>'s <a for=request>client</a>'s
<a for="environment settings object">global object</a> is a {{Window}} object; otherwise
"<code>no-window</code>".

<li><p>If <var>request</var>'s <a for=request>origin</a> is "<code>client</code>", then set
<var>request</var>'s <a for=request>origin</a> to <var>request</var>'s <a for=request>client</a>'s
<a for="environment settings object">origin</a>.
<li>
<p>If <var>request</var>'s <a for=request>traversable for user prompts</a> is "<code>client</code>":

<ol>
<li><p>Set <var>request</var>'s <a for=request>traversable for user prompts</a> to
"<code>no-traversable</code>".

<li>
<p>If <var>request</var>'s <a for=request>client</a> is non-null:

<ol>
<li><p>Let <var>global</var> be <var>request</var>'s <a for=request>client</a>'s
<a for="environment settings object">global object</a>.

<li><p>If <var>global</var> is a {{Window}} object and <var>global</var>'s
<a for=Window>navigable</a> is not null, then set <var>request</var>'s
<a for=request>traversable for user prompts</a> to <var>global</var>'s
<a for=Window>navigable</a>'s <a for=navigable>traversable navigable</a>.
</ol>
</ol>

<li>
<p>If <var>request</var>'s <a for=request>origin</a> is "<code>client</code>":

<ol>
<li><p><a>Assert</a>: <var>request</var>'s <a for=request>client</a> is non-null.

<li><p>Set <var>request</var>'s <a for=request>origin</a> to <var>request</var>'s
<a for=request>client</a>'s <a for="environment settings object">origin</a>.
</ol>

<li>
<p>If <var>request</var>'s <a for=request>policy container</a> is "<code>client</code>":
Expand Down Expand Up @@ -5517,10 +5561,11 @@ run these steps:
<a for="fetch params">canceled</a>:

<ol>
<li><p>If <var>request</var>'s <a for=request>window</a> is "<code>no-window</code>" and
<var>request</var>'s <a for=request>redirect mode</a> is "<code>error</code>", then set
<var>httpFetchParams</var> to <var>fetchParams</var> and <var>httpRequest</var> to
<var>request</var>.
<li>
<p>If <var>request</var>'s <a for=request>traversable for user prompts</a> is
"<code>no-traversable</code>" and <var>request</var>'s <a for=request>redirect mode</a> is
"<code>error</code>", then set <var>httpFetchParams</var> to <var>fetchParams</var> and
<var>httpRequest</var> to <var>request</var>.

<li>
<p>Otherwise:
Expand All @@ -5541,6 +5586,12 @@ run these steps:
<var>httpRequest</var>.
</ol>

<p class=note>If user prompts or redirects are possible, then the user agent might need to
re-send the request with a new set of headers after the user answers the prompt or the redirect
location is determined. At that time, the original request body might have been partially sent
already, so we need to clone the request (including the body) beforehand so that we have a
spare copy available.

<li>
<p>Let <var>includeCredentials</var> be true if one of

Expand Down Expand Up @@ -5919,8 +5970,8 @@ run these steps:
<li>
<p>If <var>response</var>'s <a for=response>status</a> is 401, <var>httpRequest</var>'s
<a for=request>response tainting</a> is not "<code>cors</code>", <var>includeCredentials</var> is
true, and <var>request</var>'s <a for=request>window</a> is an <a>environment settings object</a>,
then:
true, and <var>request</var>'s <a for=request>traversable for user prompts</a> is a
<a for=/>traversable navigable</a>:

<ol>
<li class=XXX><p>Needs testing: multiple `<code>WWW-Authenticate</code>` headers, missing,
Expand Down Expand Up @@ -5948,7 +5999,7 @@ run these steps:

<li><p>Let <var>username</var> and <var>password</var> be the result of prompting the end user
for a username and password, respectively, in <var>request</var>'s
<a for=request>window</a>.
<a for=request>traversable for user prompts</a>.

<li><p><a>Set the username</a> given <var>request</var>'s <a for=request>current URL</a> and
<var>username</var>.
Expand All @@ -5965,8 +6016,8 @@ run these steps:
<p>If <var>response</var>'s <a for=response>status</a> is 407, then:

<ol>
<li><p>If <var>request</var>'s <a for=request>window</a> is
"<code>no-window</code>", then return a <a>network error</a>.
<li><p>If <var>request</var>'s <a for=request>traversable for user prompts</a> is
"<code>no-traversable</code>", then return a <a>network error</a>.

<li class=XXX><p>Needs testing: multiple `<code>Proxy-Authenticate</code>` headers, missing,
parsing issues.
Expand All @@ -5976,7 +6027,7 @@ run these steps:

<li>
<p>Prompt the end user as appropriate in <var>request</var>'s
<a for=request>window</a> and store the result as a
<a for=request>traversable for user prompts</a> and store the result as a
<a>proxy-authentication entry</a>. [[!HTTP]]

<p class=note>Remaining details surrounding proxy authentication are defined by HTTP.
Expand Down Expand Up @@ -6156,10 +6207,9 @@ optional boolean <var>forceNewConnection</var> (default false), run these steps:
<p>If the HTTP request results in a TLS client certificate dialog, then:

<ol>
<li><p>If <var>request</var>'s <a for=request>window</a>
is an <a>environment settings object</a>, make the dialog
available in <var>request</var>'s
<a for=request>window</a>.
<li><p>If <var>request</var>'s <a for=request>traversable for user prompts</a> is a
<a for=/>traversable navigable</a>, then make the dialog available in <var>request</var>'s
<a for=request>traversable for user prompts</a>.

<li><p>Otherwise, return a <a>network error</a>.
</ol>
Expand Down Expand Up @@ -7741,19 +7791,19 @@ constructor steps are:
<li><p>Let <var>origin</var> be <a>this</a>'s <a>relevant settings object</a>'s
<a for="environment settings object">origin</a>.

<li><p>Let <var>window</var> be "<code>client</code>".
<li><p>Let <var>traversableForUserPrompts</var> be "<code>client</code>".

<li><p>If <var>request</var>'s <a for=request>window</a> is
an <a>environment settings object</a> and its
<li><p>If <var>request</var>'s <a for=request>traversable for user prompts</a>
is an <a>environment settings object</a> and its
<a for="environment settings object">origin</a> is <a>same origin</a> with
<var>origin</var>, then set <var>window</var> to <var>request</var>'s
<a for=request>window</a>.
<var>origin</var>, then set <var>traversableForUserPrompts</var> to
<var>request</var>'s <a for=request>traversable for user prompts</a>.

<li><p>If <var>init</var>["{{RequestInit/window}}"] <a for=map>exists</a> and is non-null, then
<a>throw</a> a {{TypeError}}.

<li><p>If <var>init</var>["{{RequestInit/window}}"] <a for=map>exists</a>, then set
<var>window</var> to "<code>no-window</code>".
<var>traversableForUserPrompts</var> to "<code>no-traversable</code>".

<li>
<p>Set <var>request</var> to a new <a for=/>request</a> with the following properties:
Expand All @@ -7774,8 +7824,8 @@ constructor steps are:
<dt><a for=request>client</a>
<dd><a>This</a>'s <a>relevant settings object</a>.

<dt><a for=request>window</a>
<dd><var>window</var>.
<dt><a for=request>traversable for user prompts</a>
<dd><var>traversableForUserPrompts</var>.

<dt><a for=request>internal priority</a>
<dd><var>request</var>'s <a for=request>internal priority</a>.
Expand Down