fetch.bs

<pre class=metadata>
Group: WHATWG
H1: Fetch
Shortname: fetch
Text Macro: TWITTER fetchstandard
Text Macro: LATESTRD 2022-12
Abstract: The Fetch standard defines requests, responses, and the process that binds them: fetching.
Translation: ja https://triple-underscore.github.io/Fetch-ja.html
Markup Shorthands: css off
Translate IDs: typedefdef-bodyinit bodyinit,dictdef-requestinit requestinit,typedefdef-requestinfo requestinfo,enumdef-requestdestination requestdestination,enumdef-requestmode requestmode,enumdef-requestcredentials requestcredentials,enumdef-requestcache requestcache,enumdef-requestredirect requestredirect,dictdef-responseinit responseinit,enumdef-responsetype responsetype
</pre>

<pre class=anchors>
urlPrefix:https://httpwg.org/specs/rfc5861.html#;type:dfn;spec:stale-while-revalidate
    url:n-the-stale-while-revalidate-cache-control-extension;text:stale-while-revalidate lifetime

urlPrefix:https://httpwg.org/specs/rfc8941.html#;type:dfn;spec:rfc8941
    url:rfc.section.2;text:structured field value
    url:text-serialize;text:serializing structured fields
    url:text-parse;text:parsing structured fields
    url:;text:structured header
    url:token;text:structured field token

urlPrefix:https://httpwg.org/specs/rfc9110.html#;type:dfn;spec:http
    url:method.overview;text:method
    url:fields.names;text:field-name
    url:fields.values;text:field-value
    url:rfc.section.9.2.1;text:unsafe

urlPrefix:https://httpwg.org/specs/rfc9111.html#;type:dfn;spec:http-caching
    url:delta-seconds;text:delta-seconds
    url:age.calculations;text:current age
    url:calculating.freshness.lifetime;text:freshness lifetime
    url:response.cacheability;text:Storing Responses in Caches
    url:invalidation;text:Invalidating Stored Responses
    url:validation.sent;text:Sending a Validation Request
    url:constructing.responses.from.caches;text:Constructing Responses from Caches
    url:freshening.responses;text:Freshening Stored Responses upon Validation

urlPrefix:https://httpwg.org/specs/rfc9112.html#;type:dfn;spec:http1
    url:status.line;text:reason-phrase

url:https://w3c.github.io/resource-timing/#dfn-mark-resource-timing;text:mark resource timing;type:dfn;spec:resource-timing

urlPrefix:https://w3c.github.io/hr-time/#;spec:hr-time
    type:dfn
        url:dfn-coarsen-time;text:coarsen time
        url:dfn-coarsened-shared-current-time;text:coarsened shared current time
        url:dfn-unsafe-shared-current-time;text:unsafe shared current time
    type:typedef;url:dom-domhighrestimestamp;text:DOMHighResTimeStamp

urlPrefix:https://tc39.es/ecma262/#;type:dfn;spec:ecma-262
    url:realm;text:realm
    url:sec-list-and-record-specification-type;text:Record
</pre>

<pre class=biblio>
{
    "HTTP": {
        "aliasOf": "RFC9110"
    },
    "HTTP-CACHING": {
        "aliasOf": "RFC9111"
    },
    "HTTP1": {
        "aliasOf": "RFC9112"
    },
    "HTTP3": {
        "aliasOf": "RFC9114"
    },
    "HTTP3-DATAGRAM": {
        "aliasOf": "RFC9297"
    },
    "REFERRER": {
        "aliasOf": "referrer-policy"
    },
    "STALE-WHILE-REVALIDATE": {
        "aliasOf": "RFC5861"
    },
    "SW": {
        "aliasOf": "service-workers"
    },
    "HSTS": {
        "aliasOf": "RFC6797"
    },
    "HTTPVERBSEC1": {
        "publisher": "US-CERT",
        "href": "https://www.kb.cert.org/vuls/id/867593",
        "title": "Multiple vendors' web servers enable HTTP TRACE method by default."
    },
    "HTTPVERBSEC2": {
        "publisher": "US-CERT",
        "href": "https://www.kb.cert.org/vuls/id/288308",
        "title": "Microsoft Internet Information Server (IIS) vulnerable to cross-site scripting via HTTP TRACK method."
    },
    "HTTPVERBSEC3": {
        "publisher": "US-CERT",
        "href": "https://www.kb.cert.org/vuls/id/150227",
        "title": "HTTP proxy default configurations allow arbitrary TCP connections."
    },
    "WEBTRANSPORT-HTTP3": {
        "authors": ["V. Vasiliev"],
        "href": "https://datatracker.ietf.org/doc/html/draft-ietf-webtrans-http3",
        "publisher": "IETF",
        "title": "WebTransport over HTTP/3"
    },
    "SVCB": {
        "authors": ["Ben Schwartz", "Mike Bishop", "Erik Nygren"],
        "href": "https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https",
        "publisher": "IETF",
        "title": "Service binding and parameter specification via the DNS (DNS SVCB and HTTPS RRs)"
    }
}
</pre>

<pre class=link-defaults>
spec:dom; type:dfn; text:element
spec:infra; type:dfn; text:implementation-defined
</pre>



<h2 id=goals class="no-num short">Goals</h2>

<p>The goal is to unify fetching across the web platform and provide consistent handling of
everything that involves, including:

<ul class=brief>
 <li>URL schemes
 <li>Redirects
 <li>Cross-origin semantics
 <li>CSP [[!CSP]]
 <li>Fetch Metadata [[!FETCH-METADATA]]
 <li>Service workers [[!SW]]
 <li>Mixed Content [[!MIX]]
 <li>Upgrade Insecure Requests [[!UPGRADE-INSECURE-REQUESTS]]
 <li>`<code>Referer</code>` [[!REFERRER]]
</ul>

<p>To do so it also supersedes the HTTP `<a http-header><code>Origin</code></a>` header semantics
originally defined in <cite>The Web Origin Concept</cite>. [[ORIGIN]]



<h2 id=preface class=short>Preface</h2>

<p>At a high level, fetching a resource is a fairly simple operation. A request goes in, a
response comes out. <!--You can't explain that! -->The details of that operation are
however quite involved and used to not be written down carefully and differ from one API
to the next.

<p>Numerous APIs provide the ability to fetch a resource, e.g. HTML's <code>img</code> and
<code>script</code> element, CSS' <code>cursor</code> and <code>list-style-image</code>,
the <code>navigator.sendBeacon()</code> and <code>self.importScripts()</code> JavaScript
APIs. The Fetch Standard provides a unified architecture for these features so they are
all consistent when it comes to various aspects of fetching, such as redirects and the
CORS protocol.

<p>The Fetch Standard also defines the <a method><code>fetch()</code></a> JavaScript API, which
exposes most of the networking functionality at a fairly low level of abstraction.



<h2 id=infrastructure>Infrastructure</h2>

<p>This specification depends on the Infra Standard. [[!INFRA]]

<p>This specification uses terminology from <cite>ABNF</cite>, <cite>Encoding</cite>,
<cite>HTML</cite>, <cite>HTTP</cite>, <cite>MIME Sniffing</cite>, <cite>Streams</cite>,
<cite>URL</cite>, <cite>Web IDL</cite>, and <cite>WebSockets</cite>.
[[!ABNF]]
[[!ENCODING]]
[[!HTML]]
[[!HTTP]]
[[!MIMESNIFF]]
[[!STREAMS]]
[[!URL]]
[[!WEBIDL]]
[[!WEBSOCKETS]]

<p><dfn>ABNF</dfn> means ABNF as augmented by HTTP (in particular the addition of <code>#</code>)
and RFC 7405. [[!RFC7405]]

<hr>

<p><dfn id=credentials export>Credentials</dfn> are HTTP cookies, TLS client certificates, and <a
lt="authentication entry">authentication entries</a> (for HTTP authentication). [[!COOKIES]]
[[!TLS]] [[!HTTP]]

<hr>

<p>A <dfn>fetch params</dfn> is a <a for=/>struct</a> used as a bookkeeping detail by the
<a for=/>fetch</a> algorithm. It has the following <a for=struct>items</a>:

<dl>
 <dt><dfn for="fetch params">request</dfn>
 <dd>A <a for=/>request</a>.

 <dt><dfn for="fetch params" id=fetch-params-process-request-body>process request body chunk length</dfn>
 (default null)
 <dt><dfn for="fetch params">process request end-of-body</dfn> (default null)
 <dt><dfn for="fetch params">process early hints response</dfn> (default null)
 <dt><dfn for="fetch params">process response</dfn> (default null)
 <dt><dfn for="fetch params">process response end-of-body</dfn> (default null)
 <dt><dfn for="fetch params">process response consume body</dfn> (default null)
 <dd>Null or an algorithm.

 <dt><dfn for="fetch params">task destination</dfn> (default null)
 <dd>Null, a <a for=/>global object</a>, or a <a for=/>parallel queue</a>.

 <dt><dfn for="fetch params">cross-origin isolated capability</dfn> (default false)
 <dd>A boolean.

 <dt><dfn for="fetch params">controller</dfn> (default a new <a for=/>fetch controller</a>)
 <dd>A <a for=/>fetch controller</a>.

 <dt><dfn for="fetch params">timing info</dfn>
 <dd>A <a for=/>fetch timing info</a>.

 <dt><dfn export for="fetch params">preloaded response candidate</dfn> (default null)
 <dd>Null, "<code>pending</code>", or a <a for=/>response</a>.
</dl>

<p>A <dfn export>fetch controller</dfn> is a <a for=/>struct</a> used to enable callers of
<a for=/>fetch</a> to perform certain operations on it after it has started. It has the following
<a for=struct>items</a>:

<dl>
 <dt><dfn for="fetch controller" export>state</dfn> (default "<code>ongoing</code>")
 <dd>"<code>ongoing</code>", "<code>terminated</code>", or "<code>aborted</code>"

 <dt><dfn for="fetch controller">full timing info</dfn> (default null)
 <dd>Null or a <a for=/>fetch timing info</a>.

 <dt><dfn for="fetch controller">report timing steps</dfn> (default null)
 <dd>Null or an algorithm accepting a <a for=/>global object</a>.

 <dt><dfn for="fetch controller">serialized abort reason</dfn> (default null)
 <dd>Null or a <a>Record</a> (result of [$StructuredSerialize$]).

 <dt><dfn for="fetch controller">next manual redirect steps</dfn> (default null)
 <dd>Null or an algorithm accepting nothing.
</dl>

<div algorithm>
<p>To <dfn export for="fetch controller" id="finalize-and-report-timing">report timing</dfn> for a
<a>fetch controller</a> <var>controller</var> given a <a for=/>global object</a> <var>global</var>:

<ol>
 <li><p><a for=/>Assert</a>: <var>controller</var>'s
 <a for="fetch controller">report timing steps</a> is non-null.

 <li><p>Call <var>controller</var>'s <a for="fetch controller">report timing steps</a> with
 <var>global</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="fetch controller">process the next manual redirect</dfn> for a
<a>fetch controller</a> <var>controller</var>:

<ol>
 <li><p><a for=/>Assert</a>: <var>controller</var>'s
 <a for="fetch controller">next manual redirect steps</a> is non-null.

 <li><p>Call <var>controller</var>'s <a for="fetch controller">next manual redirect steps</a>.
</ol>
</div>

<div algorithm>
<p>To
<dfn export for="fetch controller" id="extract-full-timing-info">extract full timing info</dfn>
given a <a>fetch controller</a> <var>controller</var>:

<ol>
 <li><p><a for=/>Assert</a>: <var>controller</var>'s <a for="fetch controller">full timing info</a>
 is non-null.

 <li><p>Return <var>controller</var>'s <a for="fetch controller">full timing info</a>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="fetch controller">abort</dfn> a <a for=/>fetch controller</a>
<var>controller</var> with an optional <var>error</var>:

<ol>
 <li><p>Set <var>controller</var>'s <a for="fetch controller">state</a> to "<code>aborted</code>".

 <li><p>Let <var>fallbackError</var> be an "{{AbortError}}" {{DOMException}}.

 <li><p>Set <var>error</var> to <var>fallbackError</var> if it is not given.

 <li><p>Let <var>serializedError</var> be [$StructuredSerialize$](<var>error</var>).
 If that threw an exception, catch it, and let <var>serializedError</var> be
 [$StructuredSerialize$](<var>fallbackError</var>).

 <li><p>Set <var>controller</var>'s <a for="fetch controller">serialized abort reason</a> to
 <var>serializedError</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export>deserialize a serialized abort reason</dfn>, given null or a <a>Record</a>
<var>abortReason</var> and a <a>realm</a> <var>realm</var>:

<ol>
 <li><p>Let <var>fallbackError</var> be an "{{AbortError}}" {{DOMException}}.

 <li><p>Let <var>deserializedError</var> be <var>fallbackError</var>.

 <li><p>If <var>abortReason</var> is non-null, then set <var>deserializedError</var> to
 [$StructuredDeserialize$](<var>abortReason</var>, <var>realm</var>). If that threw an exception or
 returned undefined, then set <var>deserializedError</var> to <var>fallbackError</var>.

 <li><p>Return <var>deserializedError</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="fetch controller">terminate</dfn> a <a for=/>fetch controller</a>
<var>controller</var>, set <var>controller</var>'s <a for="fetch controller">state</a> to
"<code>terminated</code>".
</div>

<p>A <a for=/>fetch params</a> <var>fetchParams</var> is <dfn for="fetch params">aborted</dfn> if
its <a for="fetch params">controller</a>'s <a for="fetch controller">state</a> is
"<code>aborted</code>".

<p>A <a for=/>fetch params</a> <var>fetchParams</var> is <dfn for="fetch params">canceled</dfn> if
its <a for="fetch params">controller</a>'s <a for="fetch controller">state</a> is
"<code>aborted</code>" or "<code>terminated</code>".

<p>A <dfn export>fetch timing info</dfn> is a <a for=/>struct</a> used to maintain timing
information needed by <cite>Resource Timing</cite> and <cite>Navigation Timing</cite>. It has the
following <a for=struct>items</a>: [[RESOURCE-TIMING]] [[NAVIGATION-TIMING]]

<dl>
 <dt><dfn export for="fetch timing info">start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">redirect start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">redirect end time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">post-redirect start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">final service worker start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">final network-request start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">final network-response start time</dfn> (default 0)
 <dt><dfn export for="fetch timing info">end time</dfn> (default 0)
 <dd>A {{DOMHighResTimeStamp}}.

 <dt><dfn export for="fetch timing info">final connection timing info</dfn> (default null)
 <dd>Null or a <a for=/>connection timing info</a>.

 <dt><dfn export for="fetch timing info">server-timing headers</dfn> (default « »)
 <dd>A <a for=/>list</a> of strings.
 <dt><dfn export for="fetch timing info">render-blocking</dfn> (default false)
 <dd>A boolean.
</dl>

<p>A <dfn export>response body info</dfn> is a <a for=/>struct</a> used to maintain
information needed by <cite>Resource Timing</cite> and <cite>Navigation Timing</cite>. It has the
following <a for=struct>items</a>: [[RESOURCE-TIMING]] [[NAVIGATION-TIMING]]

<dl>
 <dt><dfn export for="response body info" id="fetch-timing-info-encoded-body-size">encoded
 size</dfn> (default 0)
 <dt><dfn export for="response body info" id="fetch-timing-info-decoded-body-size">decoded
 size</dfn> (default 0)
 <dd>A number.
</dl>

<div algorithm>
<p>To
<dfn export lt="create an opaque timing info|creating an opaque timing info">create an opaque timing info</dfn>,
given a <a for=/>fetch timing info</a> <var>timingInfo</var>, return a new
<a for=/>fetch timing info</a> whose <a for="fetch timing info">start time</a> and
<a for="fetch timing info">post-redirect start time</a> are <var>timingInfo</var>'s
<a for="fetch timing info">start time</a>.
</div>

<div algorithm>
<p>To <dfn>queue a fetch task</dfn>, given an algorithm <var>algorithm</var>, a
<a for=/>global object</a> or a <a for=/>parallel queue</a> <var>taskDestination</var>, run these
steps:

<ol>
 <li><p>If <var>taskDestination</var> is a <a for=/>parallel queue</a>, then
 <a lt="enqueue steps" for="parallel queue">enqueue</a> <var>algorithm</var> to
 <var>taskDestination</var>.

 <li><p>Otherwise, <a>queue a global task</a> on the <a>networking task source</a> with
 <var>taskDestination</var> and <var>algorithm</var>.
</ol>
</div>

<hr>

<p>To <dfn>serialize an integer</dfn>, represent it as a string of the shortest possible decimal
number.

<p class=XXX>This will be replaced by a more descriptive algorithm in Infra. See
<a href="https://github.com/whatwg/infra/issues/201">infra/201</a>.


<h3 id=url>URL</h3>

<p>A <dfn export>local scheme</dfn> is "<code>about</code>", "<code>blob</code>", or
"<code>data</code>".

<p>A <a for=/>URL</a> <dfn export>is local</dfn> if its <a for=url>scheme</a> is a
<a>local scheme</a>.

<p class=note>This definition is also used by <cite>Referrer Policy</cite>. [[REFERRER]]

<p>An <dfn export id=http-scheme>HTTP(S) scheme</dfn> is "<code>http</code>" or
"<code>https</code>".

<p>A <dfn export>fetch scheme</dfn> is "<code>about</code>", "<code>blob</code>",
"<code>data</code>", "<code>file</code>", or an <a>HTTP(S) scheme</a>.

<p class=note><a>HTTP(S) scheme</a> and <a>fetch scheme</a> are also used by <cite>HTML</cite>.
[[HTML]]


<h3 id=http>HTTP</h3>

<p>While <a lt=fetch for=/>fetching</a> encompasses more than just HTTP, it
borrows a number of concepts from HTTP and applies these to resources obtained via other
means (e.g., <code>data</code> URLs).

<p>An <dfn export>HTTP tab or space</dfn> is U+0009 TAB or U+0020 SPACE.

<p><dfn export>HTTP whitespace</dfn> is U+000A LF, U+000D CR, or an <a>HTTP tab or space</a>.

<p class=note><a>HTTP whitespace</a> is only useful for specific constructs that are reused outside
the context of HTTP headers (e.g., <a for=/>MIME types</a>). For HTTP header values, using
<a>HTTP tab or space</a> is preferred, and outside that context <a>ASCII whitespace</a> is
preferred. Unlike <a>ASCII whitespace</a> this excludes U+000C FF.

<p>An <dfn export>HTTP newline byte</dfn> is 0x0A (LF) or 0x0D (CR).

<p>An <dfn export>HTTP tab or space byte</dfn> is 0x09 (HT) or 0x20 (SP).

<p>An <dfn export>HTTP whitespace byte</dfn> is an <a>HTTP newline byte</a> or
<a>HTTP tab or space byte</a>.

<div algorithm>
<p>To
<dfn export lt="collect an HTTP quoted string|collecting an HTTP quoted string">collect an HTTP quoted string</dfn>
from a <a for=/>string</a> <var>input</var>, given a <a>position variable</a> <var>position</var>
and optionally an <var>extract-value flag</var>, run these steps:

<ol>
 <li><p>Let <var>positionStart</var> be <var>position</var>.

 <li><p>Let <var>value</var> be the empty string.

 <li><p>Assert: the <a>code point</a> at <var>position</var> within <var>input</var> is U+0022 (").

 <li><p>Advance <var>position</var> by 1.

 <li>
  <p>While true:

  <ol>
   <li><p>Append the result of <a>collecting a sequence of code points</a> that are not U+0022 (")
   or U+005C (\) from <var>input</var>, given <var>position</var>, to <var>value</var>.

   <li><p>If <var>position</var> is past the end of <var>input</var>, then
   <a for=iteration>break</a>.

   <li><p>Let <var>quoteOrBackslash</var> be the <a>code point</a> at <var>position</var> within
   <var>input</var>.

   <li><p>Advance <var>position</var> by 1.

   <li>
    <p>If <var>quoteOrBackslash</var> is U+005C (\), then:

    <ol>
     <li><p>If <var>position</var> is past the end of <var>input</var>, then append U+005C (\) to
     <var>value</var> and <a for=iteration>break</a>.

     <li><p>Append the <a>code point</a> at <var>position</var> within <var>input</var> to
     <var>value</var>.

     <li><p>Advance <var>position</var> by 1.
    </ol>

   <li>
    <p>Otherwise:

    <ol>
     <li><p>Assert: <var>quoteOrBackslash</var> is U+0022 (").

     <li><p><a for=iteration>Break</a>.
    </ol>
  </ol>

 <li><p>If the <var>extract-value flag</var> is set, then return <var>value</var>.

 <li><p>Return the <a for=/>code points</a> from <var>positionStart</var> to <var>position</var>,
 inclusive, within <var>input</var>.
</ol>

<div class=example id=example-http-quoted-string>
 <table>
  <tr>
   <th>Input
   <th>Output
   <th>Output with the <var>extract-value flag</var> set
   <th>Final <a>position variable</a> value
  <tr>
   <td>"<code><mark>"\</mark></code>"
   <td>"<code>"\</code>"
   <td>"<code>\</code>"
   <td>2
  <tr>
   <td>"<code><mark>"Hello"</mark> World</code>"
   <td>"<code>"Hello"</code>"
   <td>"<code>Hello</code>"
   <td>7
  <tr>
   <td>"<code><mark>"Hello \\ World\""</mark></code>"
   <td>"<code>"Hello \\ World\""</code>"
   <td>"<code>Hello \ World"</code>"
   <td>18
 </table>
 <p class=tablenote><small>The <a>position variable</a> always starts at 0 in these examples.</small>
</div>
</div>


<h4 id=methods>Methods</h4>

<p>A <dfn export id=concept-method>method</dfn> is a <a for=/>byte sequence</a> that matches the
<a spec=http>method</a> token production.

<p id=simple-method>A <dfn export>CORS-safelisted method</dfn> is a
<a for=/>method</a> that is `<code>GET</code>`,
`<code>HEAD</code>`, or `<code>POST</code>`.

<p>A <dfn export>forbidden method</dfn> is a <a for=/>method</a> that is a
<a>byte-case-insensitive</a> match for `<code>CONNECT</code>`,
`<code>TRACE</code>`, or `<code>TRACK</code>`.
[[HTTPVERBSEC1]], [[HTTPVERBSEC2]], [[HTTPVERBSEC3]]

<p>To <dfn export for=method id=concept-method-normalize>normalize</dfn> a
<a for=/>method</a>, if it is a <a>byte-case-insensitive</a>
match for `<code>DELETE</code>`, `<code>GET</code>`,
`<code>HEAD</code>`, `<code>OPTIONS</code>`, `<code>POST</code>`, or
`<code>PUT</code>`, <a>byte-uppercase</a> it.

<p class=note><a lt=normalize for=method>Normalization</a> is done for backwards compatibility and
consistency across APIs as <a for=/>methods</a> are actually "case-sensitive".

<p id=example-normalization class=example>Using `<code>patch</code>` is highly likely to result in a
`<code>405 Method Not Allowed</code>`. `<code>PATCH</code>` is much more likely to
succeed.

<p class=note>There are no restrictions on <a for=/>methods</a>. `<code>CHICKEN</code>` is perfectly
acceptable (and not a misspelling of `<code>CHECKIN</code>`). Other than those that are
<a lt=normalize for=method>normalized</a> there are no casing restrictions either.
`<code>Egg</code>` or `<code>eGg</code>` would be fine, though uppercase is encouraged for
consistency.


<h4 id=terminology-headers>Headers</h4>

<p class=note>HTTP generally refers to a header as a "field" or "header field". The web platform
uses the more colloquial term "header". [[HTTP]]
<!-- This will become more hairy if we add trailer support. -->

<p>A <dfn export id=concept-header-list>header list</dfn> is a <a for=/>list</a> of zero or more
<a for=/>headers</a>. It is initially « ».

<p class=note>A <a for=/>header list</a> is essentially a specialized multimap: an ordered list of
key-value pairs with potentially duplicate keys. Since headers other than `<code>Set-Cookie</code>`
are always combined when exposed to client-side JavaScript, implementations could choose a more
efficient representation, as long as they also support an associated data structure for
`<code>Set-Cookie</code>` headers.

<div algorithm>
<p>To
<dfn export for="header list" id=concept-header-list-get-structured-header>get a structured field value</dfn>
given a <a for=/>header name</a> <var>name</var> and a string <var>type</var> from a
<a for=/>header list</a> <var>list</var>, run these steps:

<ol>
 <li><p>Assert: <var>type</var> is one of "<code>dictionary</code>", "<code>list</code>", or
 "<code>item</code>".

 <li><p>Let <var>value</var> be the result of <a for="header list">getting</a> <var>name</var> from
 <var>list</var>.

 <li><p>If <var>value</var> is null, then return null.

 <li><p>Let <var>result</var> be the result of <a>parsing structured fields</a> with
 <var ignore>input_string</var> set to <var>value</var> and <var ignore>header_type</var> set to
 <var>type</var>.

 <li><p>If parsing failed, then return null.

 <li><p>Return <var>result</var>.
</ol>

<p class="note"><a>Get a structured field value</a> intentionally does not distinguish between a
<a for=/>header</a> not being present and its <a for=header>value</a> failing to parse as a
<a>structured field value</a>. This ensures uniform processing across the web platform.
</div>

<div algorithm>
<p>To
<dfn export for="header list" id=concept-header-list-set-structured-header>set a structured field value</dfn>
given a <a for=/>tuple</a> (<a for=/>header name</a> <var>name</var>, <a>structured field value</a>
<var>structuredValue</var>), in a <a for=/>header list</a> <var>list</var>, run these steps:

<ol>
 <li><p>Let <var>serializedValue</var> be the result of executing the
 <a>serializing structured fields</a> algorithm on <var>structuredValue</var>.

 <li><p><a for="header list">Set</a> (<var>name</var>, <var>serializedValue</var>) in
 <var>list</var>.
</ol>

<p class=note><a>Structured field values</a> are defined as objects which HTTP can (eventually)
serialize in interesting and efficient ways. For the moment, Fetch only supports
<a>header values</a> as <a for=/>byte sequences</a>, which means that these objects can be set in
<a for=/>header lists</a> only via serialization, and they can be obtained from
<a for=/>header lists</a> only by parsing. In the future the fact that they are objects might be
preserved end-to-end. [[!RFC8941]]
</div>

<hr>

<div algorithm>
<p>A <a for=/>header list</a> <var>list</var>
<dfn export for="header list" lt="contains|does not contain">contains</dfn> a
<a for=/>header name</a> <var>name</var> if <var>list</var> <a for=list>contains</a> a
<a for=/>header</a> whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match for
<var>name</var>.
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-get>get</dfn> a <a for=/>header name</a>
<var>name</var> from a <a for=/>header list</a> <var>list</var>, run these steps:

<ol>
 <li><p>If <var>list</var> <a for="header list">does not contain</a> <var>name</var>, then return
 null.

 <li><p>Return the <a lt=value for=header>values</a> of all <a for=/>headers</a> in <var>list</var>
 whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match for <var>name</var>, separated
 from each other by 0x2C 0x20, in order.
</ol>
</div>

<div algorithm>
<p>To
<dfn export for="header list" lt="get, decode, and split|getting, decoding, and splitting" id=concept-header-list-get-decode-split>get, decode, and split</dfn>
a <a for=/>header name</a> <var>name</var> from <a for=/>header list</a> <var>list</var>, run these
steps:

<ol>
 <li><p>Let <var>value</var> be the result of <a for="header list">getting</a> <var>name</var> from
 <var>list</var>.

 <li><p>If <var>value</var> is null, then return null.

 <li><p>Return the result of <a for="header value">getting, decoding, and splitting</a>
 <var>value</var>.
</ol>
</div>

<div class=example id=example-header-list-get-decode-split>
 <p>This is how <a for="header list">get, decode, and split</a> functions in practice with
 `<code>A</code>` as the <var>name</var> argument:

 <table>
  <tr>
   <th>Headers (as on the network)
   <th>Output
  <tr>
   <td>
    <pre><code class=lang-http>
A: nosniff,
</code></pre>
   <td rowspan=2>« "<code>nosniff</code>", "" »
  <tr>
   <td>
    <pre><code class=lang-http>
A: nosniff
B: sniff
A:
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>A: text/html;", x/x</code></pre>
   <td rowspan=2>« "<code>text/html;", x/x</code>" »
  <tr>
   <td>
    <pre><code class=lang-http>
A: text/html;"
A: x/x
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>
A: x/x;test="hi",y/y
</code></pre>
   <td rowspan=2>« "<code>x/x;test="hi"</code>", "<code>y/y</code>" »
  <tr>
   <td>
    <pre><code class=lang-http>
A: x/x;test="hi"
C: **bingo**
A: y/y
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>
A: x / x,,,1
</code></pre>
   <td rowspan=2>« "<code>x / x</code>", "", "", "<code>1</code>" »
  <tr>
   <td>
    <pre><code class=lang-http>
A: x / x
A: ,
A: 1
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>
A: "1,2", 3
</code></pre>
   <td rowspan=2>« "<code>"1,2"</code>", "<code>3</code>" »
  <tr>
   <td>
    <pre><code class=lang-http>
A: "1,2"
D: 4
A: 3
</code></pre>
 </table>
</div>

<div algorithm>
<p>To
<dfn for="header value" lt="get, decode, and split|getting, decoding, and splitting">get, decode, and split</dfn>
a <a for=/>header value</a> <var>value</var>, run these steps:

<ol>
 <li><p>Let <var>input</var> be the result of <a>isomorphic decoding</a> <var>value</var>.

 <li><p>Let <var>position</var> be a <a for=string>position variable</a> for <var>input</var>,
 initially pointing at the start of <var>input</var>.

 <li><p>Let <var>values</var> be a <a for=/>list</a> of <a for=/>strings</a>, initially empty.

 <li><p>Let <var>temporaryValue</var> be the empty string.

 <li>
  <p>While <var>position</var> is not past the end of <var>input</var>:

  <ol>
   <li>
    <p>Append the result of <a>collecting a sequence of code points</a> that are not U+0022 (") or
    U+002C (,) from <var>input</var>, given <var>position</var>, to <var>temporaryValue</var>.

    <p class=note>The result might be the empty string.

   <li>
    <p>If <var>position</var> is not past the end of <var>input</var>, then:

    <ol>
     <li>
      <p>If the <a for=/>code point</a> at <var>position</var> within <var>input</var> is
      U+0022 ("), then:

      <ol>
       <li><p>Append the result of <a>collecting an HTTP quoted string</a> from <var>input</var>,
       given <var>position</var>, to <var>temporaryValue</var>.

       <li>If <var>position</var> is not past the end of <var>input</var>, then
       <a for=iteration>continue</a>.
      </ol>

     <li>
      <p>Otherwise:

      <ol>
       <li><p>Assert: the <a for=/>code point</a> at <var>position</var> within <var>input</var> is
       U+002C (,).

       <li><p>Advance <var>position</var> by 1.
      </ol>
    </ol>

   <li><p>Remove all <a>HTTP tab or space</a> from the start and end of <var>temporaryValue</var>.

   <li><p><a for=list>Append</a> <var>temporaryValue</var> to <var>values</var>.

   <li><p>Set <var>temporaryValue</var> to the empty string.
  </ol>

 <li><p>Return <var>values</var>.
</ol>

<p class=note>Except for blessed call sites, the algorithm directly above is not to be invoked
directly. Use <a for="header list">get, decode, and split</a> instead.
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-append>append</dfn> a <a for=/>header</a>
(<var>name</var>, <var>value</var>) to a <a for=/>header list</a> <var>list</var>, run these steps:

<ol>
 <li>
  <p>If <var>list</var> <a for="header list">contains</a> <var>name</var>, then set <var>name</var>
  to the first such <a for=/>header</a>'s <a for=header>name</a>.

  <p class=note>This reuses the casing of the <a for=header>name</a> of the <a for=/>header</a>
  already in <var>list</var>, if any. If there are multiple matched <a for=/>headers</a> their
  <a for=header>names</a> will all be identical.

 <li><p><a for=list>Append</a> (<var>name</var>, <var>value</var>) to <var>list</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-delete>delete</dfn> a
<a for=/>header name</a> <var>name</var> from a <a for=/>header list</a> <var>list</var>,
<a for=list>remove</a> all <a for=/>headers</a> whose <a for=header>name</a> is a
<a>byte-case-insensitive</a> match for <var>name</var> from <var>list</var>.
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-set>set</dfn> a <a for=/>header</a>
(<var>name</var>, <var>value</var>) in a <a for=/>header list</a> <var>list</var>, run these steps:

<ol>
 <li><p>If <var>list</var> <a for="header list">contains</a> <var>name</var>, then set the
 <a for=header>value</a> of the first such <a for=/>header</a> to <var>value</var> and
 <a for=list>remove</a> the others.

 <li><p>Otherwise, <a for=list>append</a> (<var>name</var>, <var>value</var>) to <var>list</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-combine>combine</dfn> a
<a for=/>header</a> (<var>name</var>, <var>value</var>) in a <a for=/>header list</a>
<var>list</var>, run these steps:

<ol>
 <li><p>If <var>list</var> <a for="header list">contains</a> <var>name</var>, then set the
 <a for=header>value</a> of the first such <a for=/>header</a> to its <a for=header>value</a>,
 followed by 0x2C 0x20, followed by <var>value</var>.

 <li><p>Otherwise, <a for=list>append</a> (<var>name</var>, <var>value</var>) to <var>list</var>.
</ol>

<p class=note><a for="header list">Combine</a> is used by {{XMLHttpRequest}} and the
<a spec=websockets lt="establish a WebSocket connection">WebSocket protocol handshake</a>.
</div>

<div algorithm>
<p>To <dfn>convert header names to a sorted-lowercase set</dfn>, given a <a for=/>list</a> of
<a lt=name for=header>names</a> <var>headerNames</var>, run these steps:

<ol>
 <li><p>Let <var>headerNamesSet</var> be a new <a for=/>ordered set</a>.

 <li><p><a for=list>For each</a> <var>name</var> of <var>headerNames</var>, <a for=set>append</a>
 the result of <a lt=byte-lowercased>byte-lowercasing</a> <var>name</var> to
 <var>headerNamesSet</var>.

 <li><p>Return the result of <a for=set>sorting</a> <var>headerNamesSet</var> in ascending order
 with <a>byte less than</a>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for="header list" id=concept-header-list-sort-and-combine>sort and combine</dfn> a
<a for=/>header list</a> <var>list</var>:

<ol>
 <li><p>Let <var>headers</var> be an empty <a for=/>list</a> of <a for=/>headers</a> with the key
 being the <a for=header>name</a> and value the <a for=header>value</a>.

 <li><p>Let <var>names</var> be the result of
 <a>convert header names to a sorted-lowercase set</a> with all the <a lt=name for=header>names</a>
 of the <a for=/>headers</a> in <var>list</var>.

 <li>
  <p><a for=list>For each</a> <var>name</var> of <var>names</var>:

  <ol>
   <li>
    <p>If <var>name</var> is `<code>set-cookie</code>`, then:

    <ol>
     <li><p>Let <var>values</var> be a list of all <a lt=value for=header>values</a> of
     <a for=/>headers</a> in <var>list</var> whose <a for=header>name</a> is a
     <a>byte-case-insensitive</a> match for <var>name</var>, in order.

     <li>
      <p><a for=list>For each</a> <var>value</var> of <var>values</var>:

      <ol>
       <li><p><a for=list>Append</a> (<var>name</var>, <var>value</var>) to <var>headers</var>.
      </ol>
    </ol>

   <li>
    <p>Otherwise:

    <ol>
     <li><p>Let <var>value</var> be the result of <a for="header list">getting</a> <var>name</var>
     from <var>list</var>.

     <li><p>Assert: <var>value</var> is non-null.

     <li><p><a for=list>Append</a> (<var>name</var>, <var>value</var>) to <var>headers</var>.
    </ol>
  </ol>

 <li><p>Return <var>headers</var>.
</ol>
</div>

<hr>

<p>A <dfn export id=concept-header>header</dfn> is a <a for=/>tuple</a> that consists of a
<dfn export for=header id=concept-header-name>name</dfn> (a <a for=/>header name</a>) and
<dfn export for=header id=concept-header-value>value</dfn> (a <a for=/>header value</a>).

<p>A <dfn export>header name</dfn> is a <a for=/>byte sequence</a> that matches the
<a spec=http>field-name</a> token production.

<p>A <dfn export>header value</dfn> is a <a for=/>byte sequence</a> that matches the following
conditions:

<ul class=brief>
 <li><p>Has no leading or trailing <a>HTTP tab or space bytes</a>.
 <li><p>Contains no 0x00 (NUL) or <a>HTTP newline bytes</a>.
</ul>

<p class=note>The definition of <a for=/>header value</a> is not defined in terms of the
<a spec=http>field-value</a> token production as it is
<a href=https://github.com/httpwg/http-core/issues/215 title="field-value value space">not compatible with deployed content</a>.

<div algorithm>
<p>To <dfn export for="header value" id=concept-header-value-normalize>normalize</dfn> a
<a for=/>byte sequence</a> <var>potentialValue</var>, remove any leading and trailing
<a>HTTP whitespace bytes</a> from <var>potentialValue</var>.
</div>

<hr>

<div algorithm>
<p id=simple-header>To determine whether a <a for=/>header</a> (<var>name</var>, <var>value</var>)
is a <dfn export>CORS-safelisted request-header</dfn>, run these steps:

<ol>
 <li><p>If <var>value</var>'s <a for="byte sequence">length</a> is greater than 128, then return
 false.

 <li>
  <p><a>Byte-lowercase</a> <var>name</var> and switch on the result:

  <dl class=switch>
   <dt>`<code>accept</code>`
   <dd>
    <p>If <var>value</var> contains a <a>CORS-unsafe request-header byte</a>, then return false.

   <dt>`<code>accept-language</code>`
   <dt>`<code>content-language</code>`
   <dd><p>If <var>value</var> contains a byte that is not in the range 0x30 (0) to 0x39 (9),
   inclusive, is not in the range 0x41 (A) to 0x5A (Z), inclusive, is not in the range 0x61 (a) to
   0x7A (z), inclusive, and is not 0x20 (SP), 0x2A (*), 0x2C (,), 0x2D (-), 0x2E (.), 0x3B (;), or
   0x3D (=), then return false.
   <!-- Maybe give Infra "byte-alphanumeric"? -->

   <dt>`<code>content-type</code>`
   <dd>
    <ol>
     <li><p>If <var>value</var> contains a <a>CORS-unsafe request-header byte</a>, then return
     false.

     <li><p>Let <var>mimeType</var> be the result of <a lt="parse a MIME type">parsing</a> the
     result of <a>isomorphic decoding</a> <var>value</var>.

     <li><p>If <var>mimeType</var> is failure, then return false.

     <li><p>If <var>mimeType</var>'s <a for="MIME type">essence</a> is not
     "<code>application/x-www-form-urlencoded</code>", "<code>multipart/form-data</code>", or
     "<code>text/plain</code>", then return false.
    </ol>

    <p class=warning>This intentionally does not use <a>extract a MIME type</a> as that algorithm is
    rather forgiving and servers are not expected to implement it.

    <div class=example id=example-cors-safelisted-request-header-content-type>
     <p>If <a>extract a MIME type</a> were used the following request would not result in a CORS
     preflight and a naïve parser on the server might treat the request body as JSON:

     <pre><code class=lang-javascript>
fetch("https://victim.example/naïve-endpoint", {
  method: "POST",
  headers: [
    ["Content-Type", "application/json"],
    ["Content-Type", "text/plain"]
  ],
  credentials: "include",
  body: JSON.stringify(exerciseForTheReader)
});
</code></pre>
    </div>

   <dt>`<code>range</code>`
   <dd>
    <ol>
     <li><p>Let <var>rangeValue</var> be the result of <a>parsing a single range header value</a>
     given <var>value</var> and false.

     <li><p>If <var>rangeValue</var> is failure, then return false.

     <li>
      <p>If <var>rangeValue</var>[0] is null, then return false.

      <p class=note>As web browsers have historically not emitted ranges such as
      `<code>bytes=-500</code>` this algorithm does not safelist them.
    </ol>

   <dt>Otherwise
   <dd><p>Return false.
  </dl>

 <li><p>Return true.
</ol>

<p class="note">There are limited exceptions to the `<code>Content-Type</code>` header safelist, as
documented in <a href=#cors-protocol-exceptions>CORS protocol exceptions</a>.
</div>

<div algorithm>
<p>A <dfn>CORS-unsafe request-header byte</dfn> is a byte <var>byte</var> for which one of the
following is true:

<ul class=brief>
 <li><p><var>byte</var> is less than 0x20 and is not 0x09 HT
 <li><p><var>byte</var> is 0x22 ("), 0x28 (left parenthesis), 0x29 (right parenthesis), 0x3A (:),
 0x3C (&lt;), 0x3E (>), 0x3F (?), 0x40 (@), 0x5B ([), 0x5C (\), 0x5D (]), 0x7B ({), 0x7D (}), or
 0x7F DEL.
 <!-- Delimiters from https://httpwg.org/specs/rfc9110.html#rule.token.separators except for ,/;=
      and including DEL -->
</ul>
</div>

<div algorithm>
<p>The <dfn noexport>CORS-unsafe request-header names</dfn>, given a <a for=/>header list</a>
<var>headers</var>, are determined as follows:

<ol>
 <li><p>Let <var>unsafeNames</var> be a new <a for=/>list</a>.

 <li><p>Let <var>potentiallyUnsafeNames</var> be a new <a for=/>list</a>.

 <li><p>Let <var>safelistValueSize</var> be 0.

 <li>
  <p><a for=list>For each</a> <var>header</var> of <var>headers</var>:

  <ol>
   <li><p>If <var>header</var> is not a <a>CORS-safelisted request-header</a>, then
   <a for=list>append</a> <var>header</var>'s <a for=header>name</a> to <var>unsafeNames</var>.

   <li><p>Otherwise, <a for=list>append</a> <var>header</var>'s <a for=header>name</a> to
   <var>potentiallyUnsafeNames</var> and increase <var>safelistValueSize</var> by
   <var>header</var>'s <a for=header>value</a>'s <a for="byte sequence">length</a>.
  </ol>

 <li><p>If <var>safelistValueSize</var> is greater than 1024, then <a for=list>for each</a>
 <var>name</var> of <var>potentiallyUnsafeNames</var>, <a for=list>append</a> <var>name</var> to
 <var>unsafeNames</var>.

 <li><p>Return the result of <a>convert header names to a sorted-lowercase set</a> with
 <var>unsafeNames</var>.
</ol>
</div>

<p>A <dfn export>CORS non-wildcard request-header name</dfn> is a <a for=/>header name</a> that is a
<a>byte-case-insensitive</a> match for `<code>Authorization</code>`.

<p>A <dfn export>privileged no-CORS request-header name</dfn> is a <a for=/>header name</a> that is
a <a>byte-case-insensitive</a> match for one of

<ul class=brief>
 <li>`<code>Range</code>`.
</ul>

<div class=note>
 <p>These are headers that can be set by privileged APIs, and will be preserved if their associated
 request object is copied, but will be removed if the request is modified by unprivileged APIs.

 <p>`<code>Range</code>` headers are commonly used by <a lt="download the hyperlink">downloads</a>
 and <a lt="resource fetch algorithm">media fetches</a>, although neither of these currently specify
 how. <a href=https://github.com/whatwg/html/pull/2814>html/2914</a> aims to solve this.

 <p>A helper is provided to <a for=request>add a range header</a> to a particular request.
</div>

<p>A <dfn export>CORS-safelisted response-header name</dfn>, given a <a for=/>list</a> of
<a for=/>header names</a> <var>list</var>, is a <a for=/>header name</a> that is a
<a>byte-case-insensitive</a> match for one of

<ul class=brief>
 <li>`<code>Cache-Control</code>`
 <li>`<code>Content-Language</code>`
 <li>`<code>Content-Length</code>`
 <li>`<code>Content-Type</code>`
 <li>`<code>Expires</code>`
 <li>`<code>Last-Modified</code>`
 <li>`<code>Pragma</code>`
 <li>Any <a for=list>item</a> in <var>list</var> that is not a
 <a>forbidden response-header name</a>.
</ul>

<p>A <dfn noexport>no-CORS-safelisted request-header name</dfn> is a <a for=/>header name</a> that
is a <a>byte-case-insensitive</a> match for one of

<ul class=brief>
 <li>`<code>Accept</code>`
 <li>`<code>Accept-Language</code>`
 <li>`<code>Content-Language</code>`
 <li>`<code>Content-Type</code>`
</ul>

<div algorithm>
<p>To determine whether a <a for=/>header</a> (<var>name</var>, <var>value</var>) is a
<dfn noexport>no-CORS-safelisted request-header</dfn>, run these steps:

<ol>
 <li><p>If <var>name</var> is not a <a>no-CORS-safelisted request-header name</a>, then return
 false.

 <li><p>Return whether (<var>name</var>, <var>value</var>) is a
 <a>CORS-safelisted request-header</a>.
</ol>
</div>

<div algorithm>
<p id=forbidden-header-name>A <a for=/>header</a> (<var>name</var>, <var>value</var>) is
<dfn export>forbidden request-header</dfn> if these steps return true:

<ol>
 <li>
  <p>If <var>name</var> is a <a>byte-case-insensitive</a> match for one of:

  <ul class=brief>
   <li>`<code>Accept-Charset</code>`
   <li>`<code>Accept-Encoding</code>`
   <li>`<a http-header><code>Access-Control-Request-Headers</code></a>`
   <li>`<a http-header><code>Access-Control-Request-Method</code></a>`
   <li>`<code>Connection</code>`
   <li>`<code>Content-Length</code>`
   <li>`<code>Cookie</code>`
   <li>`<code>Cookie2</code>`
   <li>`<code>Date</code>`
   <li>`<code>DNT</code>`
   <li>`<code>Expect</code>`
   <li>`<code>Host</code>`
   <li>`<code>Keep-Alive</code>`
   <li>`<a http-header><code>Origin</code></a>`
   <li>`<code>Referer</code>`
   <li>`<code>Set-Cookie</code>`
   <li>`<code>TE</code>`
   <li>`<code>Trailer</code>`
   <li>`<code>Transfer-Encoding</code>`
   <li>`<code>Upgrade</code>`
   <li>`<code>Via</code>`
  </ul>

  <p>then return true.

 <li><p>If <var>name</var> when <a>byte-lowercased</a> <a for="byte sequence">starts with</a>
 `<code>proxy-</code>` or `<code>sec-</code>`, then return true.

 <li>
  <p>If <var>name</var> is a <a>byte-case-insensitive</a> match for one of:

  <ul class=brief>
   <li>`<code>X-HTTP-Method</code>`
   <li>`<code>X-HTTP-Method-Override</code>`
   <li>`<code>X-Method-Override</code>`
  </ul>

  <p>then:

  <ol>
   <li><p>Let <var>parsedValues</var> be the result of
   <a for="header value">getting, decoding, and splitting</a> <var>value</var>.

   <li><p><a for=list>For each</a> <var>method</var> of <var>parsedValues</var>: if the
   <a>isomorphic encoding</a> of <var>method</var> is a <a>forbidden method</a>, then return true.
  </ol>

 <li><p>Return false.
</ol>

<div class=note>
 <p>These are forbidden so the user agent remains in full control over them.

 <p><a for=/>Header names</a> starting with `<code>Sec-</code>` are reserved to allow new
 <a for=/>headers</a> to be minted that are safe from APIs using <a for=/>fetch</a> that allow
 control over <a for=/>headers</a> by developers, such as {{XMLHttpRequest}}. [[XHR]]

 <p>The `<code>Set-Cookie</code>` header is semantically a response header, so it is not useful on
 requests. Because `<code>Set-Cookie</code>` headers cannot be combined, they require more complex
 handling in the {{Headers}} object. It is forbidden here to avoid leaking this complexity into
 requests.
</div>
</div>

<p>A <dfn export>forbidden response-header name</dfn> is a <a for=/>header name</a> that is a
<a>byte-case-insensitive</a> match for one of:

<ul class=brief>
 <li>`<code>Set-Cookie</code>`
 <li>`<code>Set-Cookie2</code>`
</ul>

<p>A <dfn export>request-body-header name</dfn> is a <a for=/>header name</a> that is a
<a>byte-case-insensitive</a> match for one of:

<ul class=brief>
 <li>`<code>Content-Encoding</code>`
 <li>`<code>Content-Language</code>`
 <li>`<code>Content-Location</code>`
 <li>`<code>Content-Type</code>`
</ul>

<hr>

<div algorithm>
<p>To <dfn export lt="extract header values|extracting header values">extract header values</dfn>
given a <a for=/>header</a> <var>header</var>, run these steps:

<ol>
 <li><p>If parsing <var>header</var>'s <a for=header>value</a>, per the <a>ABNF</a> for
 <var>header</var>'s <a for=header>name</a>, fails, then return failure.

 <li><p>Return one or more <a for=header>values</a> resulting from parsing <var>header</var>'s
 <a for=header>value</a>, per the <a>ABNF</a> for <var>header</var>'s <a for=header>name</a>.
</ol>
</div>

<div algorithm>
<p>To
<dfn export lt="extract header list values|extracting header list values">extract header list values</dfn>
given a <a for=/>header name</a> <var>name</var> and a <a for=/>header list</a> <var>list</var>,
run these steps:

<ol>
 <li><p>If <var>list</var> <a for="header list">does not contain</a> <var>name</var>, then return
 null.

 <li>
  <p>If the <a>ABNF</a> for <var>name</var> allows a single <a for=/>header</a> and <var>list</var>
  <a for="header list">contains</a> more than one, then return failure.

  <p class=note>If different error handling is needed, extract the desired <a for=/>header</a>
  first.

 <li><p>Let <var>values</var> be an empty <a for=/>list</a>.

 <li>
  <p>For each <a for=/>header</a> <var>header</var> <var>list</var>
  <a for="header list">contains</a> whose <a for=header>name</a> is <var>name</var>:

  <ol>
   <li><p>Let <var>extract</var> be the result of <a>extracting header values</a> from
   <var>header</var>.

   <li><p>If <var>extract</var> is failure, then return failure.

   <li><p>Append each <a for=header>value</a> in <var>extract</var>, in order, to <var>values</var>.
  </ol>

 <li><p>Return <var>values</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn id=simple-range-header-value>parse a single range header value</dfn> from a
<a>byte sequence</a> <var>value</var> and a boolean <var>allowWhitespace</var>, run these steps:

<ol>
 <li><p>Let <var>data</var> be the <a>isomorphic decoding</a> of <var>value</var>.

 <li><p>If <var>data</var> does not <a for=string>start with</a> "<code>bytes</code>", then return
 failure.

 <li><p>Let <var>position</var> be a <a>position variable</a> for <var>data</var>, initially
 pointing at the 5th <a>code point</a> of <var>data</var>.

 <li><p>If <var>allowWhitespace</var> is true, <a>collect a sequence of code points</a> that are
 <a>HTTP tab or space</a>, from <var>data</var> given <var>position</var>.

 <li><p>If the <a>code point</a> at <var>position</var> within <var>data</var> is not U+003D (=),
 then return failure.

 <li><p>Advance <var>position</var> by 1.

 <li><p>If <var>allowWhitespace</var> is true, <a>collect a sequence of code points</a> that are
 <a>HTTP tab or space</a>, from <var>data</var> given <var>position</var>.

 <li><p>Let <var>rangeStart</var> be the result of <a>collecting a sequence of code points</a> that
 are <a>ASCII digits</a>, from <var>data</var> given <var>position</var>.

 <li><p>Let <var>rangeStartValue</var> be <var>rangeStart</var>, interpreted as decimal number, if
 <var>rangeStart</var> is not the empty string; otherwise null.

 <li><p>If <var>allowWhitespace</var> is true, <a>collect a sequence of code points</a> that are
 <a>HTTP tab or space</a>, from <var>data</var> given <var>position</var>.

 <li><p>If the <a>code point</a> at <var>position</var> within <var>data</var> is not U+002D (-),
 then return failure.

 <li><p>Advance <var>position</var> by 1.

 <li><p>If <var>allowWhitespace</var> is true, <a>collect a sequence of code points</a> that are
 <a>HTTP tab or space</a>, from <var>data</var> given <var>position</var>.

 <li><p>Let <var>rangeEnd</var> be the result of <a>collecting a sequence of code points</a> that
 are <a>ASCII digits</a>, from <var>data</var> given <var>position</var>.

 <li><p>Let <var>rangeEndValue</var> be <var>rangeEnd</var>, interpreted as decimal number, if
 <var>rangeEnd</var> is not the empty string; otherwise null.

 <li><p>If <var>position</var> is not past the end of <var>data</var>, then return failure.

 <li><p>If <var>rangeEndValue</var> and <var>rangeStartValue</var> are null, then return failure.

 <li><p>If <var>rangeStartValue</var> and <var>rangeEndValue</var> are numbers, and
 <var>rangeStartValue</var> is greater than <var>rangeEndValue</var>, then return failure.

 <li>
  <p>Return (<var>rangeStartValue</var>, <var>rangeEndValue</var>).

  <p class="note">The range end or start can be omitted, e.g., `<code>bytes=0-</code>` or
  `<code>bytes=-500</code>` are valid ranges.
</ol>

<p class=note><a>Parse a single range header value</a> succeeds for a subset of allowed range header
values, but it is the most common form used by user agents when requesting media or resuming
downloads. This format of range header value can be set using <a>add a range header</a>.
</div>

<hr>

<p>A <dfn id=default-user-agent-value export>default `<code>User-Agent</code>` value</dfn> is an
<a>implementation-defined</a> <a for=/>header value</a> for the `<code>User-Agent</code>`
<a for=/>header</a>.

<p>The <dfn>document `<code>Accept</code>` header value</dfn> is
`<code>text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</code>`.


<h4 id=statuses>Statuses</h4>

<p>A <dfn export id=concept-status>status</dfn> is an integer in the range 0 to 999, inclusive.

<p class=XXX>Various edge cases in mapping HTTP/1's <code>status-code</code> to this concept are
worked on in <a href=https://github.com/whatwg/fetch/issues/1156>issue #1156</a>.

<p>A <dfn export>null body status</dfn> is a <a for=/>status</a> that is 101, 103, 204, 205, or 304.

<p>An <dfn export>ok status</dfn> is a <a for=/>status</a> in the range 200 to 299, inclusive.

<p>A <dfn export>redirect status</dfn> is a <a for=/>status</a> that is 301, 302, 303, 307, or 308.


<h4 id=bodies>Bodies</h4>

<p>A <dfn export id=concept-body>body</dfn> consists of:

<ul>
 <li><p>A <dfn export for=body id=concept-body-stream>stream</dfn> (a {{ReadableStream}} object).

 <li><p>A <dfn export for=body id=concept-body-source>source</dfn> (null, a
 <a for=/>byte sequence</a>, a {{Blob}} object, or a {{FormData}} object), initially null.

 <li><p>A <dfn export for=body id=concept-body-total-bytes>length</dfn> (null or an integer),
 initially null.
</ul>

<div algorithm>
<p>To <dfn export for=body id=concept-body-clone>clone</dfn> a
<a for=/>body</a> <var>body</var>, run these steps:

<ol>
 <li><p>Let « <var>out1</var>, <var>out2</var> » be the result of <a for=ReadableStream>teeing</a>
 <var>body</var>'s <a for=body>stream</a>.

 <li><p>Set <var>body</var>'s <a for=body>stream</a> to <var>out1</var>.

 <li><p>Return a <a for=/>body</a> whose
 <a for=body>stream</a> is <var>out2</var> and other members are copied from
 <var>body</var>.
</ol>
</div>

<div algorithm>
<p>To get a <a for=/>byte sequence</a> <var>bytes</var>
<dfn export for="byte sequence">as a body</dfn>, return the <a for="body with type">body</a> of the
result of <a for=BodyInit>safely extracting</a> <var>bytes</var>.
</div>

<hr>

<div algorithm>
<p>To <dfn export for=body>incrementally read</dfn> a <a for=/>body</a> <var>body</var>, given an
algorithm <var>processBodyChunk</var>, an algorithm <var>processEndOfBody</var>, an algorithm
<var>processBodyError</var>, and an optional null, <a for=/>parallel queue</a>, or
<a for=/>global object</a> <var>taskDestination</var> (default null), run these steps.
<var>processBodyChunk</var> must be an algorithm accepting a <a for=/>byte sequence</a>.
<var>processEndOfBody</var> must be an algorithm accepting no arguments. <var>processBodyError</var>
must be an algorithm accepting an exception.

<ol>
 <li><p>If <var>taskDestination</var> is null, then set <var>taskDestination</var> to the result of
 <a>starting a new parallel queue</a>.

 <li>
  <p>Let <var>reader</var> be the result of <a for=ReadableStream>getting a reader</a> for
  <var>body</var>'s <a for=body>stream</a>.

  <p class=note>This operation will not throw an exception.

 <li><p>Perform the <a>incrementally-read loop</a> given <var>reader</var>,
 <var>taskDestination</var>, <var>processBodyChunk</var>, <var>processEndOfBody</var>, and
 <var>processBodyError</var>.
</ol>
</div>

<div algorithm>
<p>To perform the <dfn>incrementally-read loop</dfn>, given a {{ReadableStreamDefaultReader}} object
<var>reader</var>, <a for=/>parallel queue</a> or <a for=/>global object</a>
<var>taskDestination</var>, algorithm <var>processBodyChunk</var>, algorithm
<var>processEndOfBody</var>, and algorithm <var>processBodyError</var>:

<ol>
 <li>
  <p>Let <var>readRequest</var> be the following <a>read request</a>:

  <dl>
   <dt><a for="read request">chunk steps</a>, given <var>chunk</var>
   <dd>
    <ol>
     <li><p>Let <var>continueAlgorithm</var> be null.

     <li><p>If <var>chunk</var> is not a {{Uint8Array}} object, then set
     <var>continueAlgorithm</var> to this step: run <var>processBodyError</var> given a
     {{TypeError}}.

     <li>
      <p>Otherwise:

      <ol>
       <li>
        <p>Let <var>bytes</var> be a <a lt="get a copy of the buffer source">copy of</a>
        <var>chunk</var>.

        <p class=note>Implementations are strongly encouraged to use an implementation strategy that
        avoids this copy where possible.

       <li>
        <p>Set <var>continueAlgorithm</var> to these steps:

        <ol>
         <li><p>Run <var>processBodyChunk</var> given <var>bytes</var>.

         <li><p>Perform the <a>incrementally-read loop</a> given <var>reader</var>,
         <var>taskDestination</var>, <var>processBodyChunk</var>, <var>processEndOfBody</var>, and
         <var>processBodyError</var>.
        </ol>
      </ol>

     <li><p><a>Queue a fetch task</a> given <var>continueAlgorithm</var> and
     <var>taskDestination</var>.
    </ol>

   <dt><a for="read request">close steps</a>
   <dd><ol><li><p><a>Queue a fetch task</a> given <var>processEndOfBody</var> and
   <var>taskDestination</var>.</ol>

   <dt><a for="read request">error steps</a>, given <var>e</var>
   <dd><ol><li><p><a>Queue a fetch task</a> to run <var>processBodyError</var> given <var>e</var>,
   with <var>taskDestination</var>.</ol>
  </dl>

 <li><p><a for=ReadableStreamDefaultReader>Read a chunk</a> from <var>reader</var> given
 <var>readRequest</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for=body>fully read</dfn> a <a for=/>body</a> <var>body</var>, given an algorithm
<var>processBody</var>, an algorithm <var>processBodyError</var>, and an optional null,
<a for=/>parallel queue</a>, or <a for=/>global object</a> <var>taskDestination</var> (default
null), run these steps. <var>processBody</var> must be an algorithm accepting a
<a for=/>byte sequence</a>. <var>processBodyError</var> must be an algorithm accepting no arguments.

<ol>
 <li><p>If <var>taskDestination</var> is null, then set <var>taskDestination</var> to the result of
 <a>starting a new parallel queue</a>.

 <li><p>Let <var>successSteps</var> given a <a>byte sequence</a> <var>bytes</var> be to
 <a>queue a fetch task</a> to run <var>processBody</var> given <var>bytes</var>, with
 <var>taskDestination</var>.

 <li><p>Let <var>errorSteps</var> be to <a>queue a fetch task</a> to run
 <var>processBodyError</var>, with <var>taskDestination</var>.

 <li><p>Let <var>reader</var> be the result of <a for=ReadableStream>getting a reader</a> for
 <var>body</var>'s <a for=body>stream</a>. If that threw an exception, then run
 <var>errorSteps</var> with that exception and return.

 <li><p><a for=ReadableStreamDefaultReader>Read all bytes</a> from
 <var>reader</var>, given <var>successSteps</var> and <var>errorSteps</var>.
</ol>
</div>

<hr>

<p>A <dfn export>body with type</dfn> is a <a for=/>tuple</a> that consists of a
<dfn export for="body with type">body</dfn> (a <a for=/>body</a>) and a
<dfn export for="body with type">type</dfn> (a <a for=/>header value</a> or null).

<hr>

<div algorithm>
<p>To <dfn export>handle content codings</dfn> given <var>codings</var> and <var>bytes</var>, run
these steps:

<ol>
 <li><p>If <var>codings</var> are not supported, then return <var>bytes</var>.

 <li><p>Return the result of decoding <var>bytes</var> with <var>codings</var> as explained in HTTP,
 if decoding does not result in an error, and failure otherwise. [[!HTTP]]
</ol>
<!-- XXX https://github.com/whatwg/fetch/issues/716
         https://github.com/httpwg/http-core/issues/58 -->
</div>


<h4 id=requests>Requests</h4>

<p class=note>This section documents how requests work in detail. To get started, see
[[#fetch-elsewhere-request]].

<p>The input to <a for=/>fetch</a> is a
<dfn export id=concept-request>request</dfn>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-method>method</dfn> (a
<a for=/>method</a>). Unless stated otherwise it is
`<code>GET</code>`.

<p class=note>This can be updated during redirects to `<code>GET</code>` as described in
<a>HTTP fetch</a>.

<p>A <a for=/>request</a> has an associated <dfn export for=request id=concept-request-url>URL</dfn>
(a <a for=/>URL</a>).

<p class=note>Implementations are encouraged to make this a pointer to the first <a for=/>URL</a> in
<a for=/>request</a>'s <a for=request>URL list</a>. It is provided as a distinct field solely for
the convenience of other standards hooking into Fetch.

<p>A <a for=/>request</a> has an associated
<dfn export>local-URLs-only flag</dfn>. Unless stated otherwise it is
unset.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-header-list>header list</dfn> (a
<a for=/>header list</a>). Unless stated otherwise it is « ».

<p>A <a for=/>request</a> has an associated
<dfn id=unsafe-request-flag export for=request>unsafe-request flag</dfn>. Unless stated otherwise it
is unset.

<p class=note>The <a>unsafe-request flag</a> is set by APIs such as
<a method><code>fetch()</code></a>  and {{XMLHttpRequest}} to ensure a <a>CORS-preflight fetch</a>
is done based on the supplied <a for=request>method</a> and <a for=request>header list</a>. It does
not free an API from outlawing <a>forbidden methods</a> and <a>forbidden request-headers</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-body>body</dfn> (null, a <a for=/>byte sequence</a>, or a
<a for=/>body</a>). Unless stated otherwise it is null.

<p class=note>A <a for=/>byte sequence</a> will be <a for=BodyInit>safely extracted</a> into a
<a for=/>body</a> early on in <a for=/>fetch</a>. As part of <a>HTTP fetch</a> it is possible for
this field to be set to null due to certain redirects.

<hr>

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-client>client</dfn> (null or an
<a>environment settings object</a>).

<p>A <a for=/>request</a> has an associated
<dfn id=concept-request-reserved-client export for=request>reserved client</dfn>
(null, an <a for=/>environment</a>, or an
<a>environment settings object</a>). Unless stated otherwise it is null.

<p class=note>This is only used by <a>navigation requests</a> and worker requests, but not service
worker requests. It references an <a for=/>environment</a> for a <a>navigation request</a> and an
<a>environment settings object</a> for a worker request.

<p>A <a for=/>request</a> has an associated
<dfn id=concept-request-replaces-client-id export for=request>replaces client id</dfn>
(a string). Unless stated otherwise it is the empty string.

<p class=note>This is only used by <a>navigation requests</a>. It is the <a for="environment">id</a>
of the <a for="environment">target browsing context</a>'s <a>active document</a>'s
<a>environment settings object</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-window>window</dfn>
("<code>no-window</code>", "<code>client</code>", or an
<a>environment settings object</a> whose
<a for="environment settings object">global object</a> is a
{{Window}} object). Unless stated otherwise it is
"<code>client</code>".

<p class=note>The "<code>client</code>" value is changed to "<code>no-window</code>" or
<a for=/>request</a>'s <a for=request>client</a> during <a lt=fetch for=/>fetching</a>. It provides
a convenient way for standards to not have to explicitly set <a for=/>request</a>'s
<a for=request>window</a>.

<p id=keep-alive-flag>A <a for=/>request</a> has an associated boolean
<dfn for=request export id=request-keepalive-flag>keepalive</dfn>. Unless stated otherwise it is
false.

<p class=note>This can be used to allow the request to outlive the
<a>environment settings object</a>, e.g., <code>navigator.sendBeacon()</code> and the HTML
<code>img</code> element use this. Requests with this set to true are subject to additional
processing requirements.

<p>A <a for=/>request</a> has an associated
<dfn for=request export>initiator type</dfn>, which is null,
"<code>audio</code>",
"<code>beacon</code>",
"<code>body</code>",
"<code>css</code>",
"<code>early-hints</code>",
"<code>embed</code>",
"<code>fetch</code>",
"<code>font</code>",
"<code>frame</code>",
"<code>iframe</code>",
"<code>image</code>",
"<code>img</code>",
"<code>input</code>",
"<code>link</code>",
"<code>object</code>",
"<code>ping</code>",
"<code>script</code>",
"<code>track</code>",
"<code>video</code>",
"<code>xmlhttprequest</code>", or
"<code>other</code>". Unless stated otherwise it is null. [[RESOURCE-TIMING]]
<!-- See https://github.com/whatwg/fetch/issues/1452 and
         https://github.com/w3c/resource-timing/issues/132 for future work -->

<p>A <a for=/>request</a> has an associated <dfn for=request export>service-workers mode</dfn>, that
is "<code>all</code>" or "<code>none</code>". Unless stated otherwise it is "<code>all</code>".

<div class=note>
 <p>This determines which service workers will receive a {{fetch!!event}} event for this fetch.

 <dl>
  <dt>"<code>all</code>"
  <dd>Relevant service workers will get a {{fetch!!event}} event for this fetch.

  <dt>"<code>none</code>"
  <dd>No service workers will get events for this fetch.
 </dl>
</div>

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-initiator>initiator</dfn>, which is
the empty string,
"<code>download</code>",
"<code>imageset</code>",
"<code>manifest</code>",
"<code>prefetch</code>",
"<code>prerender</code>", or
"<code>xslt</code>". Unless stated otherwise it is the empty string.

<p class=note>A <a for=/>request</a>'s <a for=request>initiator</a> is not particularly granular for
the time being as other specifications do not require it to be. It is primarily a specification
device to assist defining CSP and Mixed Content. It is not exposed to JavaScript. [[!CSP]] [[!MIX]]

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-destination>destination</dfn>, which is
the empty string,
"<code>audio</code>",
"<code>audioworklet</code>",
"<code>document</code>",
"<code>embed</code>",
"<code>font</code>",
"<code>frame</code>",
"<code>iframe</code>",
"<code>image</code>",
"<code>manifest</code>",
"<code>object</code>",
"<code>paintworklet</code>",
"<code>report</code>",
"<code>script</code>",
"<code>serviceworker</code>",
"<code>sharedworker</code>",
"<code>style</code>",
"<code>track</code>",
"<code>video</code>",
"<code>webidentity</code>",
"<code>worker</code>", or
"<code>xslt</code>". Unless stated otherwise it is the empty string.

<p class=note>These are reflected on {{RequestDestination}} except for "<code>serviceworker</code>"
and "<code>webidentity</code>" as fetches with those destinations skip service workers.
<!-- Dependencies:
     * CSP: https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request
     * Mixed Content
     * Preload: https://w3c.github.io/preload/#processing
     * HTML -->

<p>A <a for=/>request</a>'s <a for=request>destination</a> is
<dfn export for=request/destination>script-like</dfn> if it is "<code>audioworklet</code>",
"<code>paintworklet</code>", "<code>script</code>", "<code>serviceworker</code>",
"<code>sharedworker</code>", or "<code>worker</code>".

<p class=warning>Algorithms that use <a for=request/destination>script-like</a> should also consider
"<code>xslt</code>" as that too can cause script execution. It is not included in the list as it is
not always relevant and might require different behavior.

<div class=note id=destination-table>
 <p>The following table illustrates the relationship between a <a for=/>request</a>'s
 <a for=request>initiator</a>, <a for=request>destination</a>, CSP directives, and features. It is
 not exhaustive with respect to features. Features need to have the relevant values defined in their
 respective standards.

 <table>
  <tbody><tr>
   <th><a lt=initiator for=request>Initiator</a>
   <th><a lt=destination for=request>Destination</a>
   <th>CSP directive
   <th>Features
  <tr>
   <td rowspan=20>""
   <td>"<code>report</code>"
   <td rowspan=2>&mdash;
   <td>CSP, NEL reports.
  <tr>
   <td>"<code>document</code>"
   <td>HTML's navigate algorithm (top-level only).
  <tr>
   <td>"<code>frame</code>"
   <td><code>child-src</code>
   <td>HTML's <code>&lt;frame></code>
  <tr>
   <td>"<code>iframe</code>"
   <td><code>child-src</code>
   <td>HTML's <code>&lt;iframe></code>
  <tr>
   <td>""
   <td><code>connect-src</code>
   <td><code>navigator.sendBeacon()</code>, {{EventSource}},
   HTML's <code>&lt;a ping=""></code> and <code>&lt;area ping=""></code>,
   <a method><code>fetch()</code></a>, {{XMLHttpRequest}}, {{WebSocket}}, Cache API
  <tr>
   <td>"<code>object</code>"
   <td><code>object-src</code>
   <td>HTML's <code>&lt;object></code>
  <tr>
   <td>"<code>embed</code>"
   <td><code>object-src</code>
   <td>HTML's <code>&lt;embed></code>
  <tr>
   <td>"<code>audio</code>"
   <td><code>media-src</code>
   <td>HTML's <code>&lt;audio></code>
  <tr>
   <td>"<code>font</code>"
   <td><code>font-src</code>
   <td>CSS' <code>@font-face</code>
  <tr>
   <td>"<code>image</code>"
   <td><code>img-src</code>
   <td>HTML's <code>&lt;img src></code>, <code>/favicon.ico</code> resource,
   SVG's <code>&lt;image></code>, CSS' <code>background-image</code>, CSS'
   <code>cursor</code>, CSS' <code>list-style-image</code>, …
  <tr>
   <td>"<code>audioworklet</code>"
   <td><code>script-src</code>
   <td><code>audioWorklet.addModule()</code>
  <tr>
   <td>"<code>paintworklet</code>"
   <td><code>script-src</code>
   <td><code>CSS.paintWorklet.addModule()</code>
  <tr>
   <td>"<code>script</code>"
   <td><code>script-src</code>
   <td>HTML's <code>&lt;script></code>, <code>importScripts()</code>
  <tr>
   <td>"<code>serviceworker</code>"
   <td><code>child-src</code>, <code>script-src</code>, <code>worker-src</code>
   <td><code>navigator.serviceWorker.register()</code>
  <tr>
   <td>"<code>sharedworker</code>"
   <td><code>child-src</code>, <code>script-src</code>, <code>worker-src</code>
   <td><code>SharedWorker</code>
  <tr>
   <td>"<code>webidentity</code>"
   <td><code>connect-src</code>
   <td><code>Federated Credential Management requests</code>
  <tr>
   <td>"<code>worker</code>"
   <td><code>child-src</code>, <code>script-src</code>, <code>worker-src</code>
   <td><code>Worker</code>
  <tr>
   <td>"<code>style</code>"
   <td><code>style-src</code>
   <td>HTML's <code>&lt;link rel=stylesheet></code>, CSS' <code>@import</code>
  <tr>
   <td>"<code>track</code>"
   <td><code>media-src</code>
   <td>HTML's <code>&lt;track></code>
  <tr>
   <td>"<code>video</code>"
   <td><code>media-src</code>
   <td>HTML's <code>&lt;video></code> element
  <tr>
   <td>"<code>download</code>"
   <td>""
   <td>&mdash;
   <td>HTML's <code>download=""</code>, "Save Link As…" UI
  <tr>
   <td>"<code>imageset</code>"
   <td>"<code>image</code>"
   <td><code>img-src</code>
   <td>HTML's <code>&lt;img srcset></code> and <code>&lt;picture></code>
  <tr>
   <td>"<code>manifest</code>"
   <td>"<code>manifest</code>"
   <td><code>manifest-src</code>
   <td>HTML's <code>&lt;link rel=manifest></code>
  <tr>
   <td>"<code>prefetch</code>"
   <td rowspan=2>""
   <td rowspan=2><code>default-src</code> (no specific directive)
   <td>HTML's <code>&lt;link rel=prefetch></code>
  <tr>
   <td>"<code>prerender</code>"
   <td>HTML's <code>&lt;link rel=prerender></code>
  <tr>
   <td>"<code>xslt</code>"
   <td>"<code>xslt</code>"
   <td><code>script-src</code>
   <td><code>&lt;?xml-stylesheet></code>
 </table>

 <p>CSP's <code>form-action</code> needs to be a hook directly in HTML's navigate or form
 submission algorithm.

 <p>CSP will also need to check <a for=/>request</a>'s <a for=request>client</a>'s
 <a for="environment settings object">global object</a>'s <a>associated <code>Document</code></a>'s
 <a for=Document>ancestor navigables</a> for various CSP directives.
</div>

<hr>

<p>A <a for=/>request</a> has an associated
<dfn export for=request>priority</dfn>, which is "<code>high</code>", "<code>low</code>", or
"<code>auto</code>". Unless stated otherwise it is "<code>auto</code>".

<p>A <a for=/>request</a> has an associated
<dfn export for=request oldids=concept-request-priority>internal priority</dfn> (null or an
<a>implementation-defined</a> object). Unless otherwise stated it is null.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-origin>origin</dfn>, which is
"<code>client</code>" or an <a for=/>origin</a>. Unless stated otherwise it is
"<code>client</code>".

<p class=note>"<code>client</code>" is changed to an <a for=/>origin</a> during
<a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
<a for=/>request</a>'s <a for=request>origin</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-policy-container>policy container</dfn>, which is
"<code>client</code>" or a <a for=/>policy container</a>. Unless stated otherwise it is
"<code>client</code>".

<p class=note>"<code>client</code>" is changed to a <a for=/>policy container</a> during
<a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
<a for=/>request</a>'s <a for=request>policy container</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-referrer>referrer</dfn>, which is
"<code>no-referrer</code>", "<code>client</code>", or a <a for=/>URL</a>. Unless stated otherwise it
is "<code>client</code>".

<p class=note>"<code>client</code>" is changed to "<code>no-referrer</code>" or a <a for=/>URL</a>
during <a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
<a for=/>request</a>'s <a for=request>referrer</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-referrer-policy>referrer policy</dfn>, which is a
<a for=/>referrer policy</a>. Unless stated otherwise it is the empty string. [[!REFERRER]]

<p class=note>This can be used to override the referrer policy to be used for this
<a for=/>request</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-mode>mode</dfn>, which is
"<code>same-origin</code>", "<code>cors</code>", "<code>no-cors</code>",
"<code>navigate</code>", or "<code>websocket</code>". Unless stated otherwise, it is
"<code>no-cors</code>".

<div class=note>
 <dl>
  <dt>"<code>same-origin</code>"
  <dd>Used to ensure requests are made to same-origin URLs. <a for=/>Fetch</a> will return a
  <a>network error</a> if the request is not made to a same-origin URL.

  <dt>"<code>cors</code>"
  <dd>For requests whose <a for=request>response tainting</a> gets set to "<code>cors</code>", makes
  the request a <a>CORS request</a> — in which case, fetch will return a <a>network error</a> if the
  requested resource does not understand the <a>CORS protocol</a>, or if the requested resource is
  one that intentionally does not participate in the <a>CORS protocol</a>.

  <dt>"<code>no-cors</code>"
  <dd>Restricts requests to using <a>CORS-safelisted methods</a> and
  <a>CORS-safelisted request-headers</a>. Upon success, fetch will return an
  <a>opaque filtered response</a>.

  <dt>"<code>navigate</code>"
  <dd>This is a special mode used only when <a>navigating</a> between documents.

  <dt>"<code>websocket</code>"
  <dd>This is a special mode used only when
  <a spec=websockets lt="establish a WebSocket connection">establishing a WebSocket connection</a>.
 </dl>

 <p>Even though the default <a for=/>request</a> <a for=request>mode</a> is "<code>no-cors</code>",
 standards are highly discouraged from using it for new features. It is rather unsafe.
</div>

<p>A <a for=/>request</a> has an associated
<dfn id=use-cors-preflight-flag export for=request>use-CORS-preflight flag</dfn>. Unless stated
otherwise, it is unset.

<p class=note>The <a>use-CORS-preflight flag</a> being set is one of several conditions that results
in a <a>CORS-preflight request</a>. The <a>use-CORS-preflight flag</a> is set if either one or more
event listeners are registered on an {{XMLHttpRequestUpload}} object or if a {{ReadableStream}}
object is used in a request.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-credentials-mode>credentials mode</dfn>,
which is "<code>omit</code>", "<code>same-origin</code>", or
"<code>include</code>". Unless stated otherwise, it is "<code>same-origin</code>".

<div class=note>
 <dl>
  <dt>"<code>omit</code>"
  <dd>Excludes credentials from this request, and causes any credentials sent back in the response
  to be ignored.

  <dt>"<code>same-origin</code>"
  <dd>Include credentials with requests made to same-origin URLs, and use any credentials sent back
  in responses from same-origin URLs.

  <dt>"<code>include</code>"
  <dd>Always includes credentials with this request, and always use any credentials sent back in the
  response.
 </dl>

 <p><a for=/>Request</a>'s <a for=request>credentials mode</a> controls the flow of
 <a for=/>credentials</a> during a <a for=/>fetch</a>. When <a for=/>request</a>'s
 <a for=request>mode</a> is "<code>navigate</code>", its <a for=request>credentials mode</a> is
 assumed to be "<code>include</code>" and <a for=/>fetch</a> does not currently account for other
 values. If <cite>HTML</cite> changes here, this standard will need corresponding changes.
</div>

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-use-url-credentials-flag>use-URL-credentials flag</dfn>.
Unless stated otherwise, it is unset.

<p class=note>When this flag is set, when a <a for=/>request</a>'s
<a for=request>URL</a> has a <a for=url>username</a> and <a for=url>password</a>, and there is an
available <a>authentication entry</a> for the <a for=/>request</a>, then the <a for=/>URL</a>'s
credentials are preferred over that of the <a>authentication entry</a>. Modern specifications avoid
setting this flag, since putting credentials in <a for=/>URLs</a> is discouraged, but some older
features set it for compatibility reasons.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-cache-mode>cache mode</dfn>, which is
"<code>default</code>", "<code>no-store</code>", "<code>reload</code>",
"<code>no-cache</code>", "<code>force-cache</code>", or
"<code>only-if-cached</code>". Unless stated otherwise, it is "<code>default</code>".

<div class=note>
 <dl>
  <dt>"<code>default</code>"
  <dd><a for=/>Fetch</a> will inspect the HTTP cache on the way to the network. If the HTTP cache
  contains a matching <a>fresh response</a> it will be returned. If the HTTP cache contains a
  matching <a>stale-while-revalidate response</a> it will be returned, and a conditional network
  fetch will be made to update the entry in the HTTP cache. If the HTTP cache contains a matching
  <a>stale response</a>, a conditional network fetch will be returned to update the entry in
  the HTTP cache. Otherwise, a non-conditional network fetch will be returned to update the entry
  in the HTTP cache. [[!HTTP]] [[!HTTP-CACHING]] [[!STALE-WHILE-REVALIDATE]]

  <dt>"<code>no-store</code>"
  <dd>Fetch behaves as if there is no HTTP cache at all.

  <dt>"<code>reload</code>"
  <dd>Fetch behaves as if there is no HTTP cache on the way to the network. Ergo, it creates a
  normal request and updates the HTTP cache with the response.

  <dt>"<code>no-cache</code>"
  <dd>Fetch creates a conditional request if there is a response in the HTTP cache and a normal
  request otherwise. It then updates the HTTP cache with the response.

  <dt>"<code>force-cache</code>"
  <dd>Fetch uses any response in the HTTP cache matching the request, not paying attention to
  staleness. If there was no response, it creates a normal request and updates the HTTP cache with
  the response.

  <dt>"<code>only-if-cached</code>"
  <dd>Fetch uses any response in the HTTP cache matching the request, not paying attention to
  staleness. If there was no response, it returns a network error. (Can only be used when
  <a for=/>request</a>'s <a for=request>mode</a> is
  "<code>same-origin</code>". Any cached redirects will be followed assuming
  <a for=/>request</a>'s
  <a for=request>redirect mode</a> is "<code>follow</code>" and the
  redirects do not violate <a for=/>request</a>'s
  <a for=request>mode</a>.)
 </dl>

 <p>If <a for=request>header list</a> <a for="header list">contains</a>
 `<code>If-Modified-Since</code>`,
 `<code>If-None-Match</code>`,
 `<code>If-Unmodified-Since</code>`,
 `<code>If-Match</code>`, or
 `<code>If-Range</code>`,
 <a for=/>fetch</a> will set
 <a for=request>cache mode</a> to "<code>no-store</code>" if it is
 "<code>default</code>".
</div>

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-redirect-mode>redirect mode</dfn>, which is
"<code>follow</code>", "<code>error</code>", or "<code>manual</code>".
Unless stated otherwise, it is "<code>follow</code>".

<div class=note>
 <dl>
  <dt>"<code>follow</code>"
  <dd>Follow all redirects incurred when fetching a resource.

  <dt>"<code>error</code>"
  <dd>Return a <a>network error</a> when a request is met with a redirect.

  <dt>"<code>manual</code>"
  <dd>Retrieves an <a>opaque-redirect filtered response</a> when a request is met with a redirect,
  to allow a service worker to replay the redirect offline. The response is otherwise
  indistinguishable from a <a>network error</a>, to not violate
  <a>atomic HTTP redirect handling</a>.
 </dl>
</div>

<p>A <a for=/>request</a> has associated
<dfn export for=request id=concept-request-integrity-metadata>integrity metadata</dfn>
(a string). Unless stated otherwise, it is the empty string.

<p>A <a for=/>request</a> has associated
<dfn export for=request id=concept-request-nonce-metadata>cryptographic nonce metadata</dfn>
(a string). Unless stated otherwise, it is the empty string.

<p>A <a for=/>request</a> has associated
<dfn export for=request id=concept-request-parser-metadata>parser metadata</dfn>
which is the empty string, "<code>parser-inserted</code>", or
"<code>not-parser-inserted</code>". Unless otherwise stated, it is the empty string.

<p class=note>A <a for=/>request</a>'s <a for=request>cryptographic nonce metadata</a> and
<a for=request>parser metadata</a> are generally populated from attributes and flags on the HTML
element responsible for creating a <a for=/>request</a>. They are used by various algorithms in
<cite>Content Security Policy</cite> to determine whether requests or responses are to be blocked in
a given context. [[!CSP]]

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-reload-navigation-flag>reload-navigation flag</dfn>.
Unless stated otherwise, it is unset.

<p class=note>This flag is for exclusive use by HTML's navigate algorithm. [[!HTML]]

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-history-navigation-flag>history-navigation flag</dfn>.
Unless stated otherwise, it is unset.

<p class=note>This flag is for exclusive use by HTML's navigate algorithm. [[!HTML]]

<p>A <a for=/>request</a> has an associated boolean <dfn export for=request>user-activation</dfn>.
Unless stated otherwise, it is false.

<p class=note>This is for exclusive use by HTML's navigate algorithm. [[!HTML]]

<p>A <a for=/>request</a> has an associated boolean <dfn export for=request>render-blocking</dfn>.
Unless stated otherwise, it is false.

<p class=note>This flag is for exclusive use by HTML's render-blocking mechanism. [[!HTML]]

<hr>

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-url-list>URL list</dfn> (a <a for=/>list</a> of one or
more <a for=/>URLs</a>). Unless stated otherwise, it is a list containing a copy of
<a for=/>request</a>'s <a for=request>URL</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-current-url>current URL</dfn>. It is a pointer to the
last <a for=/>URL</a> in <a for=/>request</a>'s <a for=request>URL list</a>.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-redirect-count>redirect count</dfn>.
Unless stated otherwise, it is zero.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=concept-request-response-tainting>response tainting</dfn>,
which is "<code>basic</code>", "<code>cors</code>", or "<code>opaque</code>".
Unless stated otherwise, it is "<code>basic</code>".

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=no-cache-prevent-cache-control>prevent no-cache cache-control header modification flag</dfn>.
Unless stated otherwise, it is unset.

<p>A <a for=/>request</a> has an associated <dfn export for=request id=done-flag>done flag</dfn>.
Unless stated otherwise, it is unset.

<p>A <a for=/>request</a> has an associated
<dfn export for=request id=timing-allow-failed>timing allow failed flag</dfn>. Unless stated
otherwise, it is unset.

<p class=note>A <a for=/>request</a>'s <a for=request>URL list</a>, <a for=request>current URL</a>,
<a for=request>redirect count</a>, <a for=request>response tainting</a>,
<a for=request>done flag</a>, and <a for=request>timing allow failed flag</a> are used as
bookkeeping details by the <a for=/>fetch</a> algorithm.

<hr>

<p>A <dfn export>subresource request</dfn> is a <a for=/>request</a>
whose <a for=request>destination</a> is "<code>audio</code>", "<code>audioworklet</code>",
"<code>font</code>", "<code>image</code>", "<code>manifest</code>", "<code>paintworklet</code>",
"<code>script</code>", "<code>style</code>", "<code>track</code>", "<code>video</code>",
"<code>xslt</code>", or the empty string.

<p>A <dfn export>non-subresource request</dfn> is a <a for=/>request</a>
whose <a for=request>destination</a> is "<code>document</code>", "<code>embed</code>",
"<code>frame</code>", "<code>iframe</code>", "<code>object</code>", "<code>report</code>",
"<code>serviceworker</code>", "<code>sharedworker</code>", or "<code>worker</code>".

<p>A <dfn export>navigation request</dfn> is a <a for=/>request</a> whose
<a for=request>destination</a> is
"<code>document</code>", "<code>embed</code>", "<code>frame</code>", "<code>iframe</code>",
or "<code>object</code>".

<p class=note>See <a for=/>handle fetch</a> for usage of these terms.
[[!SW]]

<hr>

<div algorithm>
<p>A <a for=/>request</a> <var>request</var> has a
<dfn for=request id=concept-request-tainted-origin>redirect-tainted origin</dfn> if these steps
return true:

<ol>
 <li><p>Let <var>lastURL</var> be null.

 <li>
  <p><a for=list>For each</a> <var>url</var> of <var>request</var>'s <a for=request>URL list</a>:

  <ol>
   <li><p>If <var>lastURL</var> is null, then set <var>lastURL</var> to <var>url</var> and
   <a for=iteration>continue</a>.

   <li><p>If <var>url</var>'s <a for=url>origin</a> is not <a>same origin</a> with
   <var>lastURL</var>'s <a for=url>origin</a> and <var>request</var>'s <a for=request>origin</a> is
   not <a>same origin</a> with <var>lastURL</var>'s <a for=url>origin</a>, then return true.

   <li>Set <var>lastURL</var> to <var>url</var>.
  </ol>

 <li>Return false.
</ol>
</div>

<div algorithm>
<p><dfn>Serializing a request origin</dfn>, given a <a for=/>request</a> <var>request</var>, is to
run these steps:

<ol>
 <li><p>If <var>request</var> has a <a for=request>redirect-tainted origin</a>, then return
 "<code>null</code>".

 <li><p>Return <var>request</var>'s <a for=request>origin</a>,
 <a lt="ASCII serialization of an origin">serialized</a>.
</ol>
</div>

<div algorithm>
<p><dfn>Byte-serializing a request origin</dfn>, given a <a for=/>request</a> <var>request</var>,
is to return the result of <a>serializing a request origin</a> with <var>request</var>,
<a>isomorphic encoded</a>.
</div>

<hr>

<div algorithm>
<p>To <dfn export for=request id=concept-request-clone>clone</dfn> a
<a for=/>request</a> <var>request</var>, run these steps:

<ol>
 <li><p>Let <var>newRequest</var> be a copy of <var>request</var>, except for its
 <a for=request>body</a>.

 <li><p>If <var>request</var>'s <a for=request>body</a> is non-null, set <var>newRequest</var>'s
 <a for=request>body</a> to the result of <a lt=clone for=body>cloning</a> <var>request</var>'s
 <a for=request>body</a>.

 <li><p>Return <var>newRequest</var>.
</ol>
</div>

<hr>

<div algorithm>
<p>To <dfn export for=request id=concept-request-add-range-header>add a range header</dfn> to a
<a for=/>request</a> <var>request</var>, with an integer <var>first</var>, and an optional integer
<var>last</var>, run these steps:

<ol>
 <li><p>Assert: <var>last</var> is not given, or <var>first</var> is less than or equal to
 <var>last</var>.

 <li><p>Let <var>rangeValue</var> be `<code>bytes=</code>`.

 <li><p><a lt="serialize an integer">Serialize</a> and <a>isomorphic encode</a> <var>first</var>,
 and append the result to <var>rangeValue</var>.

 <li><p>Append 0x2D (-) to <var>rangeValue</var>.

 <li><p>If <var>last</var> is given, then <a lt="serialize an integer">serialize</a> and
 <a>isomorphic encode</a> it, and append the result to <var>rangeValue</var>.

 <li><p><a for="header list">Append</a> (`<code>Range</code>`, <var>rangeValue</var>) to
 <var>request</var>'s <a for=request>header list</a>.
</ol>

<p class=note>A range header denotes an inclusive byte range. There a range header where
<var>first</var> is 0 and <var>last</var> is 500, is a range of 501 bytes.

<p class=note>Features that combine multiple responses into one logical resource are historically a
source of security bugs. Please seek security review for features that deal with partial responses.
</div>

<hr>

<div algorithm>
<p>To <dfn export>serialize a response URL for reporting</dfn>, given a <a for=/>response</a>
<var>response</var>, run these steps:

<ol>
 <li><p>Assert: <var>response</var>'s <a for=response>URL list</a> <a for=list>is not empty</a>.

 <li>
  <p>Let <var>url</var> be a copy of <var>response</var>'s <a for=response>URL list</a>'s first
  element.

  <p class="note">This is not <var>response</var>'s <a for=response>URL</a> in order to avoid
  leaking information about redirect targets (see
  <a href="https://w3c.github.io/webappsec-csp/#security-violation-reports">similar considerations for CSP reporting</a>
  too). [[CSP]]

 <li><p><a>Set the username</a> given <var>url</var> and the empty string.

 <li><p><a>Set the password</a> given <var>url</var> and the empty string.

 <li><p>Return the <a lt="URL serializer">serialization</a> of <var>url</var> with
 <a for="URL serializer"><i>exclude fragment</i></a> set to true.
</ol>
</div>

<div algorithm>
<p>To check if <dfn export>Cross-Origin-Embedder-Policy allows credentials</dfn>, given a
<a for=/>request</a> <var>request</var>, run these steps:

<ol>
 <li><p>If <var>request</var>'s <a for=request>mode</a> is not "<code>no-cors</code>", then return
 true.</p>

 <li><p>If <var>request</var>'s <a for=request>client</a> is null, then return true.</p>

 <li><p>If <var>request</var>'s <a for=request>client</a>'s
 <a for="environment settings object">policy container</a>'s
 <a for="policy container">embedder policy</a>'s <a for="embedder policy">value</a> is not
 "<a for="embedder policy value"><code>credentialless</code></a>", then return true.</p>

 <li><p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
 <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> and <var>request</var>
 does not have a <a for=request>redirect-tainted origin</a>, then return true.</p>

 <li><p>Return false.</p>
</ol>
</div>


<h4 id=responses>Responses</h4>

<p>The result of <a for=/>fetch</a> is a
<dfn export id=concept-response>response</dfn>. A <a for=/>response</a>
evolves over time. That is, not all its fields are available straight away.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-type>type</dfn> which is
"<code>basic</code>",
"<code>cors</code>",
"<code>default</code>",
"<code>error</code>",
"<code>opaque</code>", or
"<code>opaqueredirect</code>".
Unless stated otherwise, it is "<code>default</code>".

<p>A <a for=/>response</a> can have an associated
<dfn export for=response id=concept-response-aborted>aborted flag</dfn>, which is initially unset.

<p class="note">This indicates that the request was intentionally aborted by the developer or
end-user.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-url>URL</dfn>. It is a pointer to the last
<a for=/>URL</a> in <a for=/>response</a>'s <a for=response>URL list</a> and null if
<a for=/>response</a>'s <a for=response>URL list</a> <a for=list>is empty</a>.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-url-list>URL list</dfn> (a <a for=/>list</a> of zero or
more <a for=/>URLs</a>). Unless stated otherwise, it is « ».

<p class=note>Except for the last <a for=/>URL</a>, if any, a <a for=/>response</a>'s
<a for=response>URL list</a> is not exposed to script as that would violate
<a>atomic HTTP redirect handling</a>.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-status>status</dfn>, which is a <a for=/>status</a>.
Unless stated otherwise it is 200.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-status-message>status message</dfn>. Unless stated
otherwise it is the empty byte sequence.

<p class=note>Responses over an HTTP/2 connection will always have the empty byte sequence as status
message as HTTP/2 does not support them.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-header-list>header list</dfn> (a
<a for=/>header list</a>). Unless stated otherwise it is « ».

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-body>body</dfn> (null or a
<a for=/>body</a>). Unless stated otherwise it is null.

<p class=note>The <a for=body>source</a> and <a for=body>length</a> concepts of a network's
<a for=/>response</a>'s <a for=response>body</a> are always null.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-cache-state>cache state</dfn> (the empty string,
"<code>local</code>", or "<code>validated</code>"). Unless stated otherwise, it is the empty
string.

<p class=note>This is intended for usage by <cite>Service Workers</cite> and
<cite>Resource Timing</cite>.  [[SW]] [[RESOURCE-TIMING]]
<!-- If we ever expand the utility of this we need to carefully consider whether filtered responses
     need to mask it, whether the cache API needs to store it, etc. -->

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-cors-exposed-header-name-list>CORS-exposed header-name list</dfn>
(a list of zero or more <a for=/>header</a>
<a lt=name for=header>names</a>). The list is empty unless otherwise specified.

<p class=note>A <a for=/>response</a> will typically get its
<a for=response>CORS-exposed header-name list</a> set by <a>extracting header values</a> from the
`<a http-header><code>Access-Control-Expose-Headers</code></a>` header. This list is used by a
<a>CORS filtered response</a> to determine which headers to expose.

<p>A <a for=/>response</a> has an associated
<dfn for=response id=concept-response-range-requested-flag>range-requested flag</dfn>, which is
initially unset.

<p class=note>This is used to prevent a partial response from an earlier ranged request being
provided to an API that didn't make a range request. See the flag's usage for a detailed description
of the attack.

<p>A <a for=/>response</a> has an associated <dfn for=response>request-includes-credentials</dfn>
(a boolean), which is initially true.

<p>A <a for=/>response</a> has an associated
<dfn for=response id=concept-response-timing-allow-passed>timing allow passed flag</dfn>, which is
initially unset.

<p class=note>This is used so that the caller to a fetch can determine if sensitive timing data is
allowed on the resource fetched by looking at the flag of the response returned. Because the flag on
the response of a redirect has to be set if it was set for previous responses in the redirect chain,
this is also tracked internally using the request's <a for=request>timing allow failed flag</a>.

<p>A <a for=/>response</a> has an associated
<dfn export for=response id=concept-response-body-info>body info</dfn>
(a <a for=/>response body info</a>). Unless stated otherwise, it is a new
<a for=/>response body info</a>.

<p>A <a for=/>response</a> has an associated
<dfn export for=response>service worker timing info</dfn> (null or a
<a for=/>service worker timing info</a>), which is initially null.

<p>A <a for=/>response</a> has an associated <dfn for=response>has-cross-origin-redirects</dfn>
(a boolean), which is initially false.

<hr>

<p>A <dfn export id=concept-network-error>network error</dfn> is a <a for=/>response</a> whose
<a for=response>type</a> is "<code>error</code>", <a for=response>status</a> is 0,
<a for=response>status message</a> is the empty byte sequence,
<a for=response>header list</a> is « », <a for=response>body</a> is null, and
<a for=response>body info</a> is a new <a for=/>response body info</a>.

<p>An <dfn export id=concept-aborted-network-error>aborted network error</dfn> is a
<a>network error</a> whose <a for=response>aborted flag</a> is set.

<div algorithm>
<p>To create the <dfn>appropriate network error</dfn> given <a for=/>fetch params</a>
<var>fetchParams</var>:

<ol>
 <li><p>Assert: <var>fetchParams</var> is <a for="fetch params">canceled</a>.

 <li><p>Return an <a>aborted network error</a> if <var>fetchParams</var> is
 <a for="fetch params">aborted</a>; otherwise return a <a>network error</a>.
</ol>
</div>

<hr>

<p>A <dfn export id=concept-filtered-response>filtered response</dfn> is a <a for=/>response</a>
that offers a limited view on an associated <a for=/>response</a>. This associated
<a for=/>response</a> can be accessed through <a>filtered response</a>'s
<dfn export id=concept-internal-response for="filtered response">internal response</dfn> (a
<a for=/>response</a> that is neither a <a for=/>network error</a> nor a
<a for=/>filtered response</a>).

<p>Unless stated otherwise a <a for=/>filtered response</a>'s associated concepts (such as its
<a for=response>body</a>) refer to the associated concepts of its
<a for="filtered response">internal response</a>. (The exceptions to this are listed below as part
of defining the concrete types of <a for=/>filtered responses</a>.)

<div class=note>
 <p>The <a for=/>fetch</a> algorithm by way of <a for=fetch><i>processResponse</i></a> and
 equivalent parameters exposes <a for=/>filtered responses</a> to callers to ensure they do not
 accidentally leak information. If the information needs to be revealed for legacy reasons, e.g., to
 feed image data to a decoder, the associated <a for="filtered response">internal response</a> can
 be used by specification algorithms.

 <p>New specifications ought not to build further on <a>opaque filtered responses</a> or
 <a>opaque-redirect filtered responses</a>. Those are legacy constructs and cannot always be
 adequately protected given contemporary computer architecture.
</div>

<p>A <dfn export id=concept-filtered-response-basic>basic filtered response</dfn> is a
<a>filtered response</a> whose
<a for=response>type</a> is "<code>basic</code>" and
<a for=response>header list</a> excludes any
<a for=/>headers</a> in
<a for="filtered response">internal response</a>'s
<a for=response>header list</a> whose
<a for=header>name</a> is a
<a>forbidden response-header name</a>.

<p>A <dfn export id=concept-filtered-response-cors>CORS filtered response</dfn> is a
<a>filtered response</a> whose
<a for=response>type</a> is "<code>cors</code>" and
<a for=response>header list</a> excludes any
<a for=/>headers</a> in
<a for="filtered response">internal response</a>'s
<a for=response>header list</a> whose
<a for=header>name</a> is <em>not</em> a
<a>CORS-safelisted response-header name</a>, given
<a for="filtered response">internal response</a>'s
<a for=response>CORS-exposed header-name list</a>.

<p>An <dfn export id=concept-filtered-response-opaque>opaque filtered response</dfn> is a
<a>filtered response</a> whose
<a for=response>type</a> is "<code>opaque</code>",
<a for=response>URL list</a> is « »,
<a for=response>status</a> is 0,
<a for=response>status message</a> is the empty byte sequence,
<a for=response>header list</a> is « »,
<a for=response>body</a> is null, and
<a for=response>body info</a> is a new <a for=/>response body info</a>.

<p>An
<dfn export id=concept-filtered-response-opaque-redirect>opaque-redirect filtered response</dfn>
is a <a>filtered response</a> whose
<a for=response>type</a> is "<code>opaqueredirect</code>",
<a for=response>status</a> is 0,
<a for=response>status message</a> is the empty byte sequence,
<a for=response>header list</a> is « »,
<a for=response>body</a> is null, and
<a for=response>body info</a> is a new <a for=/>response body info</a>.

<div class=note>
 <p>Exposing the <a for=response>URL list</a> for
 <a lt="opaque-redirect filtered response">opaque-redirect filtered responses</a> is harmless since
 no redirects are followed.

 <p>In other words, an <a>opaque filtered response</a> and an
 <a>opaque-redirect filtered response</a> are nearly indistinguishable from a <a>network error</a>.
 When introducing new APIs, do not use the <a for="filtered response">internal response</a> for
 internal specification algorithms as that will leak information.

 <p>This also means that JavaScript APIs, such as
 <a attribute for=Response lt=ok><code>response.ok</code></a>, will return rather useless results.
</div>

<div class=example id=example-filtered-responses>
 <p>The <a for=response>type</a> of a <a for=/>response</a> is exposed to script through the
 {{Response/type}} getter:

 <pre><code class=lang-javascript>
console.log(new Response().type); // "default"

console.log((await fetch("/")).type); // "basic"

console.log((await fetch("https://api.example/status")).type); // "cors"

console.log((await fetch("https://crossorigin.example/image", { mode: "no-cors" })).type); // "opaque"

console.log((await fetch("/surprise-me", { redirect: "manual" })).type); // "opaqueredirect"
</code></pre>
<!-- "error" is exposed through Response.error().type, but seems like a design mistake as
     network errors are otherwise always exposed through a TypeError exception. -->

 <p>(This assumes that the various resources exist, <code>https://api.example/status</code> has the
 appropriate CORS headers, and <code>/surprise-me</code> uses a <a>redirect status</a>.)
</div>

<hr>

<div algorithm>
<p>To <dfn export for=response id=concept-response-clone>clone</dfn> a
<a for=/>response</a> <var>response</var>, run these steps:

<ol>
 <li><p>If <var>response</var> is a <a>filtered response</a>, then return a new identical
 <a>filtered response</a> whose <a for="filtered response">internal response</a> is a
 <a for=response>clone</a> of <var>response</var>'s
 <a for="filtered response">internal response</a>.

 <li><p>Let <var>newResponse</var> be a copy of <var>response</var>, except for its
 <a for=response>body</a>.

 <li><p>If <var>response</var>'s <a for=response>body</a> is non-null, then set
 <var>newResponse</var>'s <a for=response>body</a> to the result of <a lt=clone for=body>cloning</a>
 <var>response</var>'s <a for=response>body</a>.

 <li><p>Return <var>newResponse</var>.
</ol>
</div>

<hr>

<p>A <dfn id=concept-fresh-response>fresh response</dfn> is a <a for=/>response</a> whose
<a>current age</a> is within its <a>freshness lifetime</a>.

<p>A <dfn id=concept-stale-while-revalidate-response>stale-while-revalidate response</dfn> is a
<a for=/>response</a> that is not a <a>fresh response</a> and whose <a>current age</a> is within the
<a>stale-while-revalidate lifetime</a>. [[!HTTP-CACHING]] [[!STALE-WHILE-REVALIDATE]]

<p>A <dfn export id=concept-stale-response>stale response</dfn> is a <a for=/>response</a> that is
not a <a>fresh response</a> or a <a>stale-while-revalidate response</a>.

<hr>

<div algorithm>
<p>The <dfn export for=response id=concept-response-location-url>location URL</dfn> of a
<a for=/>response</a> <var>response</var>, given null or an <a for=/>ASCII string</a>
<var>requestFragment</var>, is the value returned by the following steps. They return null, failure,
or a <a for=/>URL</a>.

<ol>
 <li><p>If <var>response</var>'s <a for=response>status</a> is not a <a>redirect status</a>, then
 return null.

 <li><p>Let <var>location</var> be the result of <a>extracting header list values</a> given
 `<code>Location</code>` and <var>response</var>'s <a for=response>header list</a>.
 <!-- https://github.com/whatwg/fetch/issues/814#issuecomment-431366126 -->

 <li>
  <p>If <var>location</var> is a <a for=/>header value</a>, then set <var>location</var> to the
  result of <a lt="url parser">parsing</a> <var>location</var> with <var>response</var>'s
  <a for=response>URL</a>.

  <p class=note>If <var>response</var> was constructed through the {{Response}} constructor,
  <var>response</var>'s <a for=response>URL</a> will be null, meaning that <var>location</var> will
  only parse successfully if it is an <a>absolute-URL-with-fragment string</a>.

 <li>
  <p>If <var>location</var> is a <a for=/>URL</a> whose <a for=url>fragment</a> is null, then set
  <var>location</var>'s <a for=url>fragment</a> to <var>requestFragment</var>.

  <p class=note>This ensures that synthetic (indeed, all) responses follow the processing model for
  redirects defined by HTTP. [[HTTP]]

 <li><p>Return <var>location</var>.
</ol>

<p class=note>The <a for=response>location URL</a> algorithm is exclusively used for redirect
handling in this standard and in <cite>HTML</cite>'s navigate algorithm which handles redirects
manually. [[!HTML]]
</div>


<h4 id=miscellaneous>Miscellaneous</h4>

<p>A <dfn export id=concept-potential-destination>potential destination</dfn> is
"<code>fetch</code>" or a <a for=request>destination</a> which is not the empty string.

<div algorithm>
<p>To <dfn export for=destination id=concept-potential-destination-translate>translate</dfn> a
<a for=/>potential destination</a> <var>potentialDestination</var>, run these steps:

<ol>
 <li><p>If <var>potentialDestination</var> is "<code>fetch</code>", then return the empty string.

 <li><p>Assert: <var>potentialDestination</var> is a <a for=request>destination</a>.

 <li><p>Return <var>potentialDestination</var>.
</ol>
</div>


<h3 id=authentication-entries>Authentication entries</h3>

<p>An <dfn export>authentication entry</dfn> and a <dfn export>proxy-authentication entry</dfn> are
tuples of username, password, and realm, used for HTTP authentication and HTTP proxy authentication,
and associated with one or more <a for=/>requests</a>.
<p>User agents should allow both to be cleared together with HTTP cookies and similar tracking
functionality.
<!-- fingerprinting -->

<p>Further details are defined by HTTP. [[!HTTP]] [[!HTTP-CACHING]]


<h3 id=fetch-groups>Fetch groups</h3>

<p>Each <a>environment settings object</a> has an associated
<dfn export id=concept-fetch-group for=fetch>fetch group</dfn>.

<p>A <a for=fetch>fetch group</a> holds an ordered list of
<dfn lt="fetch record" export for="fetch group" id=concept-fetch-record>fetch records</dfn>.

<p>A <a for="fetch group">fetch record</a> has an associated
<dfn export for="fetch record" id=concept-fetch-record-request>request</dfn> (a
<a for=/>request</a>).

<p>A <a for="fetch group">fetch record</a> has an associated
<dfn export for="fetch record" id=concept-fetch-record-fetch>controller</dfn> (a
<a for=/>fetch controller</a> or null).

<hr>

<p>When a <a for=fetch>fetch group</a> is
<dfn export for="fetch group" id=concept-fetch-group-terminate>terminated</dfn>, for each associated
<a for="fetch group">fetch record</a> whose <a for="fetch group">fetch record</a>'s
<a for="fetch record">controller</a> is non-null, and whose <a for="fetch record">request</a>'s
<a>done flag</a> is unset or <a for=request>keepalive</a> is false,
<a for="fetch controller">terminate</a> the <a for="fetch group">fetch record</a>'s
<a for="fetch record">controller</a>.


<h3 id=resolving-domains>Resolving domains</h3>

<div algorithm>
<p tracking-vector>To
<dfn export id=resolve-an-origin oldids=resolve-a-domain>resolve an origin</dfn>, given a
<a for=/>network partition key</a> <var>key</var> and an <a for=/>origin</a> <var>origin</var>:
<!-- Should we assert the scheme here to be an HTTP(S) scheme or a WebRTC scheme? -->

<ol>
 <li><p>If <var>origin</var>'s <a for=origin>host</a> is an <a for=/>IP address</a>, then return
 « <var>origin</var>'s <a for=origin>host</a> ».

 <li><p>If <var>origin</var>'s <a for=origin>host</a>'s <a for=host>public suffix</a> is
 "<code>localhost</code>" or "<code>localhost.</code>", then return « <code>::1</code>,
 <code>127.0.0.1</code> ».

 <li>
  <p>Perform an <a>implementation-defined</a> operation to turn <var>origin</var> into a
  <a for=/>set</a> of one or more <a for=/>IP addresses</a>.

  <p>It is also <a>implementation-defined</a> whether other operations might be performed to get
  connection information beyond just <a for=/>IP addresses</a>. For example, if <var>origin</var>'s
  <a for=origin>scheme</a> is an <a>HTTP(S) scheme</a>, the implementation might perform a DNS query
  for HTTPS RRs. [[SVCB]]

  <p>If this operation succeeds, return the <a for=/>set</a> of <a for=/>IP addresses</a> and any
  additional <a>implementation-defined</a> information.
 </li>

 <li><p>Return failure.
</ol>

<p>The results of <a>resolve an origin</a> may be cached. If they are cached, <var>key</var> should
be used as part of the cache key.

<div class=note>
 <p>Typically this operation would involve DNS and as such caching can happen on DNS servers without
 <var>key</var> being taken into account. Depending on the implementation it might also not be
 possible to take <var>key</var> into account locally. [[RFC1035]]

 <p>The order of the <a for=/>IP addresses</a> that the <a>resolve an origin</a> algorithm can return
 can differ between invocations.

 <p>The particulars (apart from the cache key) are not tied down as they are not pertinent to the
 system the Fetch Standard establishes. Other documents ought not to build on this primitive without
 having a considered discussion with the Fetch Standard community first.
</div>
</div>


<h3 id=connections>Connections</h3>

<p>A user agent has an associated <dfn export id=concept-connection-pool>connection pool</dfn>. A
<a>connection pool</a> is an <a for=/>ordered set</a> of zero or more
<dfn lt=connection export id=concept-connection>connections</dfn>. Each <a>connection</a> is
identified by an associated <dfn for=connection>key</dfn> (a <a>network partition key</a>),
<dfn for=connection>origin</dfn> (an <a for=/>origin</a>), and <dfn for=connection>credentials</dfn>
(a boolean).

<p>Each <a>connection</a> has an associated
<dfn for=connection id=concept-connection-timing-info>timing info</dfn> (a
<a for=/>connection timing info</a>).

<p>A <dfn export>connection timing info</dfn> is a <a for=/>struct</a> used to maintain timing
information pertaining to the process of obtaining a connection. It has the following
<a for=struct>items</a>:

<dl>
 <dt><dfn export for="connection timing info">domain lookup start time</dfn> (default 0)
 <dt><dfn export for="connection timing info">domain lookup end time</dfn> (default 0)
 <dt><dfn export for="connection timing info">connection start time</dfn> (default 0)
 <dt><dfn export for="connection timing info">connection end time</dfn> (default 0)
 <dt><dfn export for="connection timing info">secure connection start time</dfn> (default 0)
 <dd>A {{DOMHighResTimeStamp}}.

 <dt><dfn export for="connection timing info">ALPN negotiated protocol</dfn> (default the empty
 <a for=/>byte sequence</a>)
 <dd>A <a for=/>byte sequence</a>.
</dl>

<div algorithm>
<p>To <dfn>clamp and coarsen connection timing info</dfn>, given a
<a for=/>connection timing info</a> <var>timingInfo</var>, a {{DOMHighResTimeStamp}}
<var>defaultStartTime</var>, and a boolean <var>crossOriginIsolatedCapability</var>, run these
steps:

<ol>
 <li><p>If <var>timingInfo</var>'s <a for="connection timing info">connection start time</a> is
 less than <var>defaultStartTime</var>, then return a new <a for=/>connection timing info</a> whose
 <a for="connection timing info">domain lookup start time</a> is <var>defaultStartTime</var>,
 <a for="connection timing info">domain lookup end time</a> is <var>defaultStartTime</var>,
 <a for="connection timing info">connection start time</a> is <var>defaultStartTime</var>,
 <a for="connection timing info">connection end time</a> is <var>defaultStartTime</var>,
 <a for="connection timing info">secure connection start time</a> is <var>defaultStartTime</var>,
 and <a for="connection timing info">ALPN negotiated protocol</a> is <var>timingInfo</var>'s
 <a for="connection timing info">ALPN negotiated protocol</a>.

 <li><p>Return a new <a for=/>connection timing info</a> whose
 <a for="connection timing info">domain lookup start time</a> is the result of <a>coarsen time</a>
 given <var>timingInfo</var>'s <a for="connection timing info">domain lookup start time</a> and
 <var>crossOriginIsolatedCapability</var>,
 <a for="connection timing info">domain lookup end time</a> is the result of <a>coarsen time</a>
 given <var>timingInfo</var>'s <a for="connection timing info">domain lookup end time</a> and
 <var>crossOriginIsolatedCapability</var>, <a for="connection timing info">connection start time</a>
 is the result of <a>coarsen time</a> given <var>timingInfo</var>'s
 <a for="connection timing info">connection start time</a> and
 <var>crossOriginIsolatedCapability</var>, <a for="connection timing info">connection end time</a>
 is the result of <a>coarsen time</a> given <var>timingInfo</var>'s
 <a for="connection timing info">connection end time</a> and
 <var>crossOriginIsolatedCapability</var>,
 <a for="connection timing info">secure connection start time</a> is the result of
 <a>coarsen time</a> given <var>timingInfo</var>'s
 <a for="connection timing info">connection end time</a> and
 <var>crossOriginIsolatedCapability</var>, and
 <a for="connection timing info">ALPN negotiated protocol</a> is <var>timingInfo</var>'s
 <a for="connection timing info">ALPN negotiated protocol</a>.
</ol>
</div>

<hr>

<p>A <dfn>new connection setting</dfn> is "<code>no</code>", "<code>yes</code>", or
"<code>yes-and-dedicated</code>".

<div algorithm="obtain a connection">
<p>To <dfn export id=concept-connection-obtain>obtain a connection</dfn>, given a
<a>network partition key</a> <var>key</var>, <a for=/>URL</a> <var>url</var>, boolean
<var>credentials</var>, an optional <a>new connection setting</a> <var>new</var> (default
"<code>no</code>"), and an optional boolean
<dfn export for="obtain a connection"><var>http3Only</var></dfn> (default false), run these steps:
<!-- new's "yes-and-dedicated" and http3Only have been added for WebTransport -->

<ol>
 <li>
  <p>If <var>new</var> is "<code>no</code>", then:

  <ol>
   <li><p>Let <var>connections</var> be a set of <a>connections</a> in the user agent's
   <a>connection pool</a> whose <a for=connection>key</a> is <var>key</var>,
   <a for=connection>origin</a> is <var>url</var>'s <a for=url>origin</a>, and
   <a for=connection>credentials</a> is <var>credentials</var>.

   <li><p>If <var>connections</var> is not empty and <var>http3Only</var> is false, then return
   one of <var>connections</var>.

   <li><p>If there is an HTTP/3 <a>connection</a> in <var>connections</var>, then return that
   <a>connection</a>.
  </ol>

 <li>
  <p>Let <var>proxies</var> be the result of finding proxies for <var>url</var> in an
  <a>implementation-defined</a> manner. If there are no proxies, let <var>proxies</var> be
  « "<code>DIRECT</code>" ».

  <p class=note>This is where non-standard technology such as
  <a href="https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol">Web Proxy Auto-Discovery Protocol (WPAD)</a>
  and <a href="https://en.wikipedia.org/wiki/Proxy_auto-config">proxy auto-config (PAC)</a> come
  into play. The "<code>DIRECT</code>" value means to not use a proxy for this particular
  <var>url</var>.

 <li><p>Let <var>timingInfo</var> be a new <a for=/>connection timing info</a>.

 <li>
  <p><a for=list>For each</a> <var>proxy</var> of <var>proxies</var>:

  <ol>
   <li><p>Set <var>timingInfo</var>'s <a for="connection timing info">domain lookup start time</a>
   to the <a for=/>unsafe shared current time</a>.

   <li><p>Let <var>hosts</var> be « <var>url</var>'s <a for=url>origin</a>'s
   <a for=origin>host</a> ».

   <li><p>If <var>proxy</var> is "<code>DIRECT</code>", then set <var>hosts</var> to the result of
   running <a>resolve an origin</a> given <var>key</var> and <var>url</var>'s <a for=url>origin</a>.

   <li><p>If <var>hosts</var> is failure, then <a for=iteration>continue</a>.

   <li><p>Set <var>timingInfo</var>'s <a for="connection timing info">domain lookup end time</a> to
   the <a for=/>unsafe shared current time</a>.

   <li>
    <p>Let <var>connection</var> be the result of running this step: run <a>create a connection</a>
    given <var>key</var>, <var>url</var>'s <a for=url>origin</a>, <var>credentials</var>,
    <var>proxy</var>, an <a>implementation-defined</a> <a for=/>host</a> from <var>hosts</var>,
    <var>timingInfo</var>, and <var>http3Only</var> an <a>implementation-defined</a> number of
    times, <a>in parallel</a> from each other, and wait for at least 1 to return a value. In an
    <a>implementation-defined</a> manner, select a value to return from the returned values and
    return it. Any other returned values that are <a>connections</a> may be closed.

    <p class=note>Essentially this allows an implementation to pick one or more
    <a for=/>IP addresses</a> from the return value of <a>resolve an origin</a> (assuming
    <var>proxy</var> is "<code>DIRECT</code>") and race them against each other, favor
    <a for=/>IPv6 addresses</a>, retry in case of a timeout, etc.

   <li><p>If <var>connection</var> is failure, then <a for=iteration>continue</a>.

   <li><p>If <var>new</var> is not "<code>yes-and-dedicated</code>", then <a for=set>append</a>
   <var>connection</var> to the user agent's <a>connection pool</a>.

   <li><p>Return <var>connection</var>.
  </ol>

 <li><p>Return failure.
</ol>

<p class=note>This is intentionally a little vague as there are a lot of nuances to connection
management that are best left to the discretion of implementers. Describing this helps explain the
<code>&lt;link rel=preconnect></code> feature and clearly stipulates that <a>connections</a> are
keyed on <a for=/>credentials</a>. The latter clarifies that, e.g., TLS session identifiers are not
reused across <a>connections</a> whose <a for=connection>credentials</a> are false with
<a>connections</a> whose <a for=connection>credentials</a> are true.
</div>

<hr>

<div algorithm>
<p>To <dfn>create a connection</dfn>, given a <a for=/>network partition key</a> <var>key</var>,
<a for=/>origin</a> <var>origin</var>, boolean <var>credentials</var>, string <var>proxy</var>,
<a for=/>host</a> <var>host</var>, <a for=/>connection timing info</a> <var>timingInfo</var>, and
boolean <var>http3Only</var>, run these steps:

<ol>
 <li><p>Set <var>timingInfo</var>'s <a for="connection timing info">connection start time</a> to the
 <a for=/>unsafe shared current time</a>.

 <li>
  <p>Let <var>connection</var> be a new <a for=/>connection</a> whose <a for=connection>key</a> is
  <var>key</var>, <a for=connection>origin</a> is <var>origin</var>,
  <a for=connection>credentials</a> is <var>credentials</var>, and <a for=connection>timing info</a>
  is <var>timingInfo</var>. <a for=/>Record connection timing info</a> given <var>connection</var>
  and use <var>connection</var> to establish an HTTP connection to <var>host</var>, taking
  <var>proxy</var> and <var>origin</var> into account. [[!HTTP]] [[!HTTP1]] [[!TLS]]

  <p>If <var>http3Only</var> is true, then establish an HTTP/3 connection. [[!HTTP3]]

  <p>When establishing an HTTP/3 connection, include SETTINGS_ENABLE_WEBTRANSPORT with a value of 1
  and H3_DATAGRAM with a value of 1 in the initial SETTINGS frame. [[!WEBTRANSPORT-HTTP3]]
  [[!HTTP3-DATAGRAM]]

  <p>If <var>credentials</var> is false, then do <em>not</em> send a TLS client certificate.

  <p>If establishing a connection does not succeed (e.g., a TCP or TLS error), then return failure.

 <li>
  <p>Set <var>timingInfo</var>'s <a for="connection timing info">ALPN negotiated protocol</a> to
  <var>connection</var>'s ALPN Protocol ID, with the following caveats: [[RFC7301]]

  <ul>
   <li><p>When a proxy is configured, if a tunnel connection is established then this must be the
   ALPN Protocol ID of the tunneled protocol, otherwise it must be the ALPN Protocol ID of the first
   hop to the proxy.

   <li>
    <p>In case the user agent is using an experimental, non-registered protocol, the user agent must
    use the used ALPN Protocol ID, if any. If ALPN was not used for protocol negotiations, the user
    agent may use another descriptive string.

    <p class=note><var>timingInfo</var>'s
    <a for="connection timing info">ALPN negotiated protocol</a> is intended to identify the network
    protocol in use regardless of how it was actually negotiated; that is, even if ALPN is not used
    to negotiate the network protocol, this is the ALPN Protocol IDs that indicates the protocol in
    use.
  </ul>

  <p class=note>IANA maintains a
  <a href="https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids">list of ALPN Protocol IDs</a>.

 <li><p>Return <var>connection</var>.
</ol>
</div>

<hr>

<div algorithm>
<p>To <dfn>record connection timing info</dfn> given a <a for=/>connection</a>
<var>connection</var>, let <var>timingInfo</var> be <var>connection</var>'s
<a for=connection>timing info</a> and observe these requirements:

<ul>
 <li>
  <p><var>timingInfo</var>'s <a for="connection timing info">connection end time</a> should be the
  <a for=/>unsafe shared current time</a> immediately after establishing the connection to the
  server or proxy, as follows:

  <ul>
   <li><p>The returned time must include the time interval to establish the transport connection, as
   well as other time intervals such as SOCKS authentication. It must include the time interval to
   complete enough of the TLS handshake to request the resource.

   <li><p>If the user agent used TLS False Start for this connection, this interval must not include
   the time needed to receive the server's Finished message. [[RFC7918]]

   <li><p>If the user agent sends the request with early data without waiting for the full handshake
   to complete, this interval must not include the time needed to receive the server's ServerHello
   message. [[RFC8470]]

   <li><p>If the user agent waits for full handshake completion to send the request, this interval
   includes the full TLS handshake even if other requests were sent using early data on
   <var>connection</var>.
  </ul>

  <p class=example id=example-connection-end-time>Suppose the user agent establishes an HTTP/2
  connection over TLS 1.3 to send a <code>GET</code> request and a <code>POST</code> request. It
  sends the ClientHello at time <var>t1</var> and then sends the <code>GET</code> request with early
  data. The <code>POST</code> request is not safe ([[HTTP]], section 9.2.1), so the user
  agent waits to complete the handshake at time <var>t2</var> before sending it. Although both
  requests used the same connection, the <code>GET</code> request reports a connection end time of
  <var>t1</var>, while the <code>POST</code> request reports <var>t2</var>.

 <li><p>If a secure transport is used, <var>timingInfo</var>'s
 <a for="connection timing info">secure connection start time</a> should be the result of calling
 <a for=/>unsafe shared current time</a> immediately before starting the handshake process to
 secure <var>connection</var>. [[!TLS]]

 <li><p>If <var>connection</var> is an HTTP/3 connection, <var>timingInfo</var>'s
 <a for="connection timing info">connection start time</a> and <var>timingInfo</var>'s
 <a for="connection timing info">secure connection start time</a> must be equal. (In HTTP/3
 the secure transport handshake process is performed as part of the initial connection setup.)
 [[!HTTP3]]
</ul>

<p class=note>The <a for=/>clamp and coarsen connection timing info</a> algorithm ensures that
details of reused connections are not exposed and time values are coarsened.
</div>


<h3 id=network-partition-keys>Network partition keys</h3>

<p>A <dfn>network partition key</dfn> is a tuple consisting of a <a for=/>site</a> and null or
an <a>implementation-defined</a> value.

<div algorithm>
<p>To <dfn export>determine the network partition key</dfn>, given an
<a for=/>environment</a> <var>environment</var>:

<ol>
 <li><p>Let <var>topLevelOrigin</var> be <var>environment</var>'s
 <a for="environment">top-level origin</a>.

 <li><p>If <var>topLevelOrigin</var> is null, then set <var>topLevelOrigin</var> to
 <var>environment</var>'s <a for="environment">top-level creation URL</a>'s <a for=url>origin</a>.

 <li><p>Assert: <var>topLevelOrigin</var> is an <a for=/>origin</a>.

 <li><p>Let <var>topLevelSite</var> be the result of <a lt="obtain a site">obtaining a site</a>,
 given <var>topLevelOrigin</var>.

 <li>
  <p>Let <var>secondKey</var> be null or an <a>implementation-defined</a> value.

  <p class=XXX>The second key is intentionally a little vague as the finer points are still
  evolving. See <a href=https://github.com/whatwg/fetch/issues/1035>issue #1035</a>.

 <li><p>Return (<var>topLevelSite</var>, <var>secondKey</var>).
</ol>
</div>

<div algorithm>
<p>To <dfn for=request>determine the network partition key</dfn>, given a <a for=/>request</a>
<var>request</var>:

<ol>
 <li><p>If <var>request</var>'s <a for=request>reserved client</a> is non-null, then return the
 result of <a for=/>determining the network partition key</a> given <var>request</var>'s
 <a for=request>reserved client</a>.

 <li><p>If <var>request</var>'s <a for=request>client</a> is non-null, then return the
 result of <a for=/>determining the network partition key</a> given <var>request</var>'s
 <a for=request>client</a>.

 <li><p>Return null.
</ol>
</div>


<h3 id=http-cache-partitions>HTTP cache partitions</h3>

<div algorithm>
<p>To <dfn>determine the HTTP cache partition</dfn>, given a <a for=/>request</a> <var>request</var>:

<ol>
 <li><p>Let <var>key</var> be the result of <a for=request>determining the network partition key</a>
 given <var>request</var>.

 <li><p>If <var>key</var> is null, then return null.

 <li><p>Return the unique HTTP cache associated with <var>key</var>. [[!HTTP-CACHING]]
</ol>
</div>


<h3 id=port-blocking>Port blocking</h3>

<p class=note>New protocols can avoid the need for blocking ports by negotiating the protocol
through TLS using ALPN. The protocol cannot be spoofed through HTTP requests in that case.
[[RFC7301]]

<div algorithm>
<p>To determine whether fetching a <a for=/>request</a> <var>request</var>
<dfn export lt="block bad port">should be blocked due to a bad port</dfn>:

<ol>
 <li><p>Let <var>url</var> be <var>request</var>'s <a for=request>current URL</a>.

 <li><p>If <var>url</var>'s <a for=url>scheme</a> is an <a>HTTP(S) scheme</a> and <var>url</var>'s
 <a for=url>port</a> is a <a>bad port</a>, then return <b>blocked</b>.

 <li><p>Return <b>allowed</b>.
</ol>
</div>

<p>A <a for=url>port</a> is a
<dfn export>bad port</dfn> if it is listed in the first column of the following table.

<table>
 <tbody><tr><th>Port<th>Typical service
 <tr><td>1<td>tcpmux
 <tr><td>7<td>echo
 <tr><td>9<td>discard
 <tr><td>11<td>systat
 <tr><td>13<td>daytime
 <tr><td>15<td>netstat
 <tr><td>17<td>qotd
 <tr><td>19<td>chargen
 <tr><td>20<td>ftp-data
 <tr><td>21<td>ftp
 <tr><td>22<td>ssh
 <tr><td>23<td>telnet
 <tr><td>25<td>smtp
 <tr><td>37<td>time
 <tr><td>42<td>name
 <tr><td>43<td>nicname
 <tr><td>53<td>domain
 <tr><td>69<td>tftp
 <tr><td>77<td>—
 <tr><td>79<td>finger
 <tr><td>87<td>—
 <tr><td>95<td>supdup
 <tr><td>101<td>hostname
 <tr><td>102<td>iso-tsap
 <tr><td>103<td>gppitnp
 <tr><td>104<td>acr-nema
 <tr><td>109<td>pop2
 <tr><td>110<td>pop3
 <tr><td>111<td>sunrpc
 <tr><td>113<td>auth
 <tr><td>115<td>sftp
 <tr><td>117<td>uucp-path
 <tr><td>119<td>nntp
 <tr><td>123<td>ntp
 <tr><td>135<td>epmap
 <tr><td>137<td>netbios-ns
 <tr><td>139<td>netbios-ssn
 <tr><td>143<td>imap
 <tr><td>161<td>snmp
 <tr><td>179<td>bgp
 <tr><td>389<td>ldap
 <tr><td>427<td>svrloc
 <tr><td>465<td>submissions
 <tr><td>512<td>exec
 <tr><td>513<td>login
 <tr><td>514<td>shell
 <tr><td>515<td>printer
 <tr><td>526<td>tempo
 <tr><td>530<td>courier
 <tr><td>531<td>chat
 <tr><td>532<td>netnews
 <tr><td>540<td>uucp
 <tr><td>548<td>afp
 <tr><td>554<td>rtsp
 <tr><td>556<td>remotefs
 <tr><td>563<td>nntps
 <tr><td>587<td>submission
 <tr><td>601<td>syslog-conn
 <tr><td>636<td>ldaps
 <tr><td>989<td>ftps-data
 <tr><td>990<td>ftps
 <tr><td>993<td>imaps
 <tr><td>995<td>pop3s
 <tr><td>1719<td>h323gatestat
 <tr><td>1720<td>h323hostcall
 <tr><td>1723<td>pptp
 <tr><td>2049<td>nfs
 <tr><td>3659<td>apple-sasl
 <tr><td>4045<td>npp
 <tr><td>5060<td>sip
 <tr><td>5061<td>sips
 <tr><td>6000<td>x11
 <tr><td>6566<td>sane-port
 <tr><td>6665<td>ircu
 <tr><td>6666<td>ircu
 <tr><td>6667<td>ircu
 <tr><td>6668<td>ircu
 <tr><td>6669<td>ircu
 <tr><td>6697<td>ircs-u
 <tr><td>10080<td>amanda
</table>
<!-- Service names per
     https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt -->


<div algorithm="should response to request be blocked due to mime type">
<h3 dfn export lt="should response to request be blocked due to mime type" id=should-response-to-request-be-blocked-due-to-mime-type?>Should
<var>response</var> to <var>request</var> be blocked due to its MIME type?</h3>

<p>Run these steps:

<ol>
 <li><p>Let <var>mimeType</var> be the result of <a for="header list">extracting a MIME type</a>
 from <var>response</var>'s <a for=response>header list</a>.

 <li><p>If <var>mimeType</var> is failure, then return <b>allowed</b>.

 <li><p>Let <var>destination</var> be <var>request</var>'s <a for=request>destination</a>.

 <li>
  <p>If <var>destination</var> is <a for=request/destination>script-like</a> and one of the
  following is true, then return <b>blocked</b>:

  <ul class=brief>
   <li><var>mimeType</var>'s <a for="MIME type">essence</a> <a for=string>starts with</a>
   "<code>audio/</code>", "<code>image/</code>", or "<code>video/</code>".
   <li><var>mimeType</var>'s <a for="MIME type">essence</a> is "<code>text/csv</code>".
  </ul>

 <li><p>Return <b>allowed</b>.
</ol>
</div>



<h2 id=http-extensions>HTTP extensions</h2>

<h3 id=origin-header>`<code>Origin</code>` header</h3>

<p>The `<dfn export http-header id=http-origin><code>Origin</code></dfn>`
request <a for=/>header</a> indicates where a
<a for=/>fetch</a> originates from.

<p class=note>The `<a http-header><code>Origin</code></a>` header is a version of the
`<code>Referer</code>` [sic] header that does not reveal a <a for=url>path</a>. It is used for all
<a lt="HTTP fetch">HTTP fetches</a> whose <a for=/>request</a>'s
<a for=request>response tainting</a> is "<code>cors</code>", as well as those where
<a for=/>request</a>'s <a for=request>method</a> is neither `<code>GET</code>` nor
`<code>HEAD</code>`. Due to compatibility constraints it is not included in all
<a lt=fetch for=/>fetches</a>.
<!-- Ian Hickson told me Adam Barth researched that -->

<p>Its possible <a for=header>values</a> are all the return values of
<a>byte-serializing a request origin</a>, given a <a for=/>request</a>.

<p class=note>This supplants the definition in <cite>The Web Origin Concept</cite>. [[ORIGIN]]

<hr>

<div algorithm>
<p>To <dfn id=append-a-request-origin-header>append a request `<code>Origin</code>` header</dfn>,
given a <a for=/>request</a> <var>request</var>, run these steps:

<ol>
 <li><p>Let <var>serializedOrigin</var> be the result of <a>byte-serializing a request origin</a>
 with <var>request</var>.

 <li><p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>cors</code>" or
 <var>request</var>'s <a for=request>mode</a> is "<code>websocket</code>", then
 <a for="header list">append</a> (`<code>Origin</code>`, <var>serializedOrigin</var>) to
 <var>request</var>'s <a for=request>header list</a>.

 <li>
  <p>Otherwise, if <var>request</var>'s <a for=request>method</a> is neither `<code>GET</code>` nor
  `<code>HEAD</code>`, then:

  <ol>
   <li>
    <p>If <var>request</var>'s <a for=request>mode</a> is not "<code>cors</code>",
    then switch on <var>request</var>'s <a for=request>referrer policy</a>:

    <dl class=switch>
     <dt>"<code>no-referrer</code>"
     <dd><p>Set <var>serializedOrigin</var> to `<code>null</code>`.

     <dt>"<code>no-referrer-when-downgrade</code>"
     <dt>"<code>strict-origin</code>"
     <dt>"<code>strict-origin-when-cross-origin</code>"
     <dd><p>If <var>request</var>'s <a for=request>origin</a> is a <a>tuple origin</a>, its
     <var>scheme</var> is "<code>https</code>", and <var>request</var>'s
     <a for=request>current URL</a>'s <var>scheme</var> is not "<code>https</code>", then set
     <var>serializedOrigin</var> to `<code>null</code>`.

     <dt>"<code>same-origin</code>"
     <dd><p>If <var>request</var>'s <a for=request>origin</a> is not <a>same origin</a> with
     <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a>, then set
     <var>serializedOrigin</var> to `<code>null</code>`.

     <dt>Otherwise
     <dd>Do nothing.
    </dl>

   <li><p><a for="header list">Append</a> (`<code>Origin</code>`, <var>serializedOrigin</var>) to
   <var>request</var>'s <a for=request>header list</a>.
  </ol>
</ol>

<p class=note>A <a for=/>request</a>'s <a for=request>referrer policy</a> is taken into account for
all fetches where the fetcher did not explicitly opt into sharing their <a for=/>origin</a> with the
server, e.g., via using the <a>CORS protocol</a>.
</div>


<h3 id=http-cors-protocol>CORS protocol</h3>

<p>To allow sharing responses cross-origin and allow for more versatile
<a lt=fetch for=/>fetches</a> than possible with HTML's
<{form}> element, the <dfn export>CORS protocol</dfn> exists. It
is layered on top of HTTP and allows responses to declare they can be shared with other
<a for=/>origins</a>.

<p class=note>It needs to be an opt-in mechanism to prevent leaking data from responses behind a
firewall (intranets). Additionally, for <a for=/>requests</a> including
<a for=/>credentials</a> it needs to be opt-in to prevent leaking potentially-sensitive data.

<p>This section explains the <a>CORS protocol</a> as it pertains to server developers.
Requirements for user agents are part of the <a for=/>fetch</a> algorithm,
except for the <a href=#http-new-header-syntax>new HTTP header syntax</a>.


<h4 id=general>General</h4>

<p>The <a>CORS protocol</a> consists of a set of headers that indicates whether a response can
be shared cross-origin.

<p>For <a for=/>requests</a> that are more involved than what is possible with HTML's <{form}>
element, a <a>CORS-preflight request</a> is performed, to ensure <a for=/>request</a>'s
<a for=request>current URL</a> supports the <a>CORS protocol</a>.


<h4 id=http-requests>HTTP requests</h4>

<p>A <dfn export>CORS request</dfn> is an HTTP request that includes an
`<a http-header><code>Origin</code></a>` header. It cannot be reliably identified as participating
in the <a>CORS protocol</a> as the `<a http-header><code>Origin</code></a>` header is also included
for all <a for=/>requests</a> whose <a for=request>method</a> is neither `<code>GET</code>` nor
`<code>HEAD</code>`.

<p>A <dfn id=cors-preflight-request export>CORS-preflight request</dfn> is a <a>CORS request</a>
that checks to see if the <a>CORS protocol</a> is understood. It uses `<code>OPTIONS</code>` as
<a for=/>method</a> and includes these <a for=/>headers</a>:

<dl>
 <dt>`<dfn export http-header id=http-access-control-request-method><code>Access-Control-Request-Method</code></dfn>`
 <dd><p>Indicates which <a for=/>method</a> a future
 <a>CORS request</a> to the same resource might use.

 <dt>`<dfn export http-header id=http-access-control-request-headers><code>Access-Control-Request-Headers</code></dfn>`
 <dd><p>Indicates which <a for=/>headers</a> a future
 <a>CORS request</a> to the same resource might use.
</dl>


<h4 id=http-responses>HTTP responses</h4>

<p>An HTTP response to a <a>CORS request</a> can include the following
<a for=/>headers</a>:

<dl>
 <dt>`<dfn export http-header id=http-access-control-allow-origin><code>Access-Control-Allow-Origin</code></dfn>`
 <dd><p>Indicates whether the response can be shared, via returning the literal
 <a for=header>value</a> of the
 `<a http-header><code>Origin</code></a>` request <a for=/>header</a>
 (which can be `<code>null</code>`) or `<code>*</code>` in a response.

 <dt>`<dfn export http-header id=http-access-control-allow-credentials><code>Access-Control-Allow-Credentials</code></dfn>`
 <dd>
  <p>Indicates whether the response can be shared when <a for=/>request</a>'s
  <a for=request>credentials mode</a> is
  "<code>include</code>".

  <p class=note>For a <a>CORS-preflight request</a>, <a for=/>request</a>'s
  <a for=request>credentials mode</a> is always "<code>same-origin</code>", i.e., it excludes
  credentials, but for any subsequent <a>CORS requests</a> it might not be. Support therefore needs
  to be indicated as part of the HTTP response to the <a>CORS-preflight request</a> as well.
</dl>

<p>An HTTP response to a <a>CORS-preflight request</a> can include the following
<a for=/>headers</a>:

<dl>
 <dt>`<dfn export http-header id=http-access-control-allow-methods><code>Access-Control-Allow-Methods</code></dfn>`
 <dd>
  <p>Indicates which <a for=/>methods</a> are supported by the <a for=/>response</a>'s
  <a for=response>URL</a> for the purposes of the <a>CORS protocol</a>.

  <p class=note>The `<code>Allow</code>` <a for=/>header</a> is
  not relevant for the purposes of the <a>CORS protocol</a>.

 <dt>`<dfn export http-header id=http-access-control-allow-headers><code>Access-Control-Allow-Headers</code></dfn>`
 <dd><p>Indicates which <a for=/>headers</a> are supported by the <a for=/>response</a>'s
 <a for=response>URL</a> for the purposes of the <a>CORS protocol</a>.

 <dt>`<dfn export http-header id=http-access-control-max-age><code>Access-Control-Max-Age</code></dfn>`
 <dd><p>Indicates the number of seconds (5 by default) the information provided by the
 `<a http-header><code>Access-Control-Allow-Methods</code></a>` and
 `<a http-header><code>Access-Control-Allow-Headers</code></a>` <a for=/>headers</a> can be cached.
</dl>

<p>An HTTP response to a <a>CORS request</a> that is not a
<a>CORS-preflight request</a> can also include the following
<a for=/>header</a>:

<dl>
 <dt>`<dfn export http-header id=http-access-control-expose-headers><code>Access-Control-Expose-Headers</code></dfn>`
 <dd><p>Indicates which <a for=/>headers</a> can be exposed as part
 of the response by listing their <a lt=name for=header>names</a>.
</dl>

<hr>

<p>A successful HTTP response, i.e., one where the server developer intends to share it, to a
<a>CORS request</a> can use any <a for=/>status</a>, as long as it includes the <a for=/>headers</a>
stated above with <a for=header>values</a> matching up with the request.

<p>A successful HTTP response to a <a>CORS-preflight request</a> is similar, except it is restricted
to an <a for=/>ok status</a>, e.g., 200 or 204.

<p>Any other kind of HTTP response is not successful and will either end up not being shared or fail
the <a>CORS-preflight request</a>. Be aware that any work the server performs might nonetheless leak
through side channels, such as timing. If server developers wish to denote this explicitly, the 403
<a for=/>status</a> can be used, coupled with omitting the relevant <a for=/>headers</a>.

<p class=note>If desired, “failure” could also be shared, but that would make it a successful HTTP
response. That is why for a successful HTTP response to a <a>CORS request</a> that is not a
<a>CORS-preflight request</a> the <a for=/>status</a> can be anything, including 403.

<p>Ultimately server developers have a lot of freedom in how they handle HTTP responses and these
tactics can differ between the response to the <a>CORS-preflight request</a> and the
<a>CORS request</a> that follows it:

<ul>
 <li><p>They can provide a static response. This can be helpful when working with caching
 intermediaries. A static response can both be successful and not successful depending on the
 <a>CORS request</a>. This is okay.

 <li><p>They can provide a dynamic response, tuned to <a>CORS request</a>. This can be helpful when
 the response body is to be tailored to a specific origin or a response needs to have credentials
 and be successful for a set of origins.
</ul>


<h4 id=http-new-header-syntax>HTTP new-header syntax</h4>

<p><a>ABNF</a> for the <a lt=value for=header>values</a> of the
<a for=/>headers</a> used by the <a>CORS protocol</a>:

<pre><code class=lang-abnf>
Access-Control-Request-Method    = <a spec=http>method</a>
Access-Control-Request-Headers   = 1#<a spec=http>field-name</a>

wildcard                         = "*"
Access-Control-Allow-Origin      = origin-or-null / wildcard
Access-Control-Allow-Credentials = %s"true" ; case-sensitive
Access-Control-Expose-Headers    = #<a spec=http>field-name</a>
Access-Control-Max-Age           = <a spec=http-caching>delta-seconds</a>
Access-Control-Allow-Methods     = #<a spec=http>method</a>
Access-Control-Allow-Headers     = #<a spec=http>field-name</a>
</code></pre>

<p class=note>For `<code>Access-Control-Expose-Headers</code>`,
`<code>Access-Control-Allow-Methods</code>`, and `<code>Access-Control-Allow-Headers</code>`
response <a for=/>headers</a>, the <a for=header>value</a> `<code>*</code>` counts as a wildcard for
<a for=/>requests</a> without <a for=/>credentials</a>. For such <a for=/>requests</a> there is no
way to solely match a <a for=/>header name</a> or <a for=/>method</a> that is `<code>*</code>`.


<h4 id=cors-protocol-and-credentials>CORS protocol and credentials</h4>

<!-- non-normative -->

<p>When <a for=/>request</a>'s
<a for=request>credentials mode</a> is "<code>include</code>" it
has an impact on the functioning of the <a>CORS protocol</a> other than including
<a for=/>credentials</a> in the <a for=/>fetch</a>.

<div id=example-xhr-credentials class=example>
 <p>In the old days, {{XMLHttpRequest}} could be used to set
 <a for=/>request</a>'s
 <a for=request>credentials mode</a> to "<code>include</code>":

 <pre><code class=lang-javascript>
var client = new XMLHttpRequest()
client.open("GET", "./")
client.withCredentials = true
/* … */
</code></pre>

 <p>Nowadays, <code>fetch("./", { credentials:"include" }).then(/* … */)</code>
 suffices.
</div>

<p>A <a for=/>request</a>'s
<a for=request>credentials mode</a> is not necessarily observable
on the server; only when <a for=/>credentials</a> exist for a
<a for=/>request</a> can it be observed by virtue of the
<a for=/>credentials</a> being included. Note that even so, a <a>CORS-preflight request</a>
never includes <a for=/>credentials</a>.

<p>The server developer therefore needs to decide whether or not responses "tainted" with
<a for=/>credentials</a> can be shared. And also needs to decide if
<a for=/>requests</a> necessitating a <a>CORS-preflight request</a> can
include <a for=/>credentials</a>. Generally speaking, both sharing responses and allowing requests
with <a for=/>credentials</a> is rather unsafe, and extreme care has to be taken to avoid the
<a href=https://en.wikipedia.org/wiki/Confused_deputy_problem>confused deputy problem</a>.
<!-- Turn into a reference? Meh. -->

<p>To share responses with <a for=/>credentials</a>, the
`<a http-header><code>Access-Control-Allow-Origin</code></a>` and
`<a http-header><code>Access-Control-Allow-Credentials</code></a>` <a for=/>headers</a> are
important. The following table serves to illustrate the various legal and illegal combinations for a
request to <code>https://rabbit.invalid/</code>:

<table>
 <tbody><tr>
  <th>Request's credentials mode
  <th>`<a http-header><code>Access-Control-Allow-Origin</code></a>`
  <th>`<a http-header><code>Access-Control-Allow-Credentials</code></a>`
  <th>Shared?
  <th>Notes
 <tr>
  <td>"<code>omit</code>"
  <td>`<code>*</code>`
  <td>Omitted
  <td>✅
  <td>—
 <tr>
  <td>"<code>omit</code>"
  <td>`<code>*</code>`
  <td>`<code>true</code>`
  <td>✅
  <td>If credentials mode is not "<code>include</code>", then
  `<a http-header><code>Access-Control-Allow-Credentials</code></a>` is ignored.
 <tr>
  <td>"<code>omit</code>"
  <td>`<code>https://rabbit.invalid/</code>`
  <td>Omitted
  <td>❌
  <td>A <a lt="serialization of an origin">serialized</a> origin has no trailing slash.
 <tr>
  <td>"<code>omit</code>"
  <td>`<code>https://rabbit.invalid</code>`
  <td>Omitted
  <td>✅
  <td>—
 <tr>
  <td>"<code>include</code>"
  <td>`<code>*</code>`
  <td>`<code>true</code>`
  <td>❌
  <td>If credentials mode is "<code>include</code>", then
  `<a http-header><code>Access-Control-Allow-Origin</code></a>` cannot be
  `<code>*</code>`.
 <tr>
  <td>"<code>include</code>"
  <td>`<code>https://rabbit.invalid</code>`
  <td>`<code>true</code>`
  <td>✅
  <td>—
 <tr>
  <td>"<code>include</code>"
  <td>`<code>https://rabbit.invalid</code>`
  <td>`<code>True</code>`
  <td>❌
  <td>`<code>true</code>` is (byte) case-sensitive.
</table>

<p>Similarly, `<a http-header><code>Access-Control-Expose-Headers</code></a>`,
`<a http-header><code>Access-Control-Allow-Methods</code></a>`, and
`<a http-header><code>Access-Control-Allow-Headers</code></a>` response headers can only use
`<code>*</code>` as value when <a for=/>request</a>'s <a for=request>credentials mode</a> is not
"<code>include</code>".


<h4 id=cors-protocol-examples>Examples</h4>

<div id=example-simple-cors class=example>
 <p>A script at <code>https://foo.invalid/</code> wants to fetch some data from
 <code>https://bar.invalid/</code>. (Neither <a for=/>credentials</a> nor response header access is
 important.)

 <pre id=unicorn><code class=lang-javascript>
var url = "https://bar.invalid/api?key=730d67a37d7f3d802e96396d00280768773813fbe726d116944d814422fc1a45&amp;data=about:unicorn";
fetch(url).then(success, failure)
</code></pre>

 <p>This will use the <a>CORS protocol</a>, though this is entirely transparent to the
 developer from <code>foo.invalid</code>. As part of the <a>CORS protocol</a>, the user agent
 will include the `<a http-header><code>Origin</code></a>` header in the request:

 <pre><code class=lang-http>
Origin: https://foo.invalid
</code></pre>

 <p>Upon receiving a response from <code>bar.invalid</code>, the user agent will verify the
 `<a http-header><code>Access-Control-Allow-Origin</code></a>` response header. If its value is
 either `<code>https://foo.invalid</code>` or `<code>*</code>`, the user agent will invoke the
 <code>success</code> callback. If it has any other value, or is missing, the user agent will invoke
 the <code>failure</code> callback.
</div>

<div id=example-cors-with-response-header class=example>
 <p>The developer of <code>foo.invalid</code> is back, and now wants to fetch some data from
 <code>bar.invalid</code> while also accessing a response header.

 <pre><code class=lang-javascript>
fetch(url).then(response => {
  var hsts = response.headers.get("strict-transport-security"),
      csp = response.headers.get("content-security-policy")
  log(hsts, csp)
})
</code></pre>

 <p><code>bar.invalid</code> provides a correct
 `<a http-header><code>Access-Control-Allow-Origin</code></a>` response header per the earlier
 example. The values of <code>hsts</code> and <code>csp</code> will depend on the
 `<a http-header><code>Access-Control-Expose-Headers</code></a>` response header. For example, if
 the response included the following headers

 <pre><code class=lang-http>
Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Access-Control-Expose-Headers: Content-Security-Policy
</code></pre>

 <p>then <code>hsts</code> would be null and <code>csp</code> would be
 "<code>default-src 'self'</code>", even though the response did include both headers. This is
 because <code>bar.invalid</code> needs to explicitly share each header by listing their names in
 the `<a http-header><code>Access-Control-Expose-Headers</code></a>` response header.

 <p>Alternatively, if <code>bar.invalid</code> wanted to share all its response headers, for
 requests that do not include <a for=/>credentials</a>, it could use `<code>*</code>` as value for
 the `<a http-header><code>Access-Control-Expose-Headers</code></a>` response header. If the request
 would have included <a for=/>credentials</a>, the response header names would have to be listed
 explicitly and `<code>*</code>` could not be used.
</div>

<div id=example-cors-with-credentials class=example>
 <p>The developer of <code>foo.invalid</code> returns, now fetching some data from
 <code>bar.invalid</code> while including <a for=/>credentials</a>. This time around the
 <a>CORS protocol</a> is no longer transparent to the developer as <a for=/>credentials</a>
 require an explicit opt-in:

 <pre><code class=lang-javascript>
fetch(url, { credentials:"include" }).then(success, failure)
</code></pre>

 <p>This also makes any `<code>Set-Cookie</code>` response headers <code>bar.invalid</code>
 includes fully functional (they are ignored otherwise).

 <p>The user agent will make sure to include any relevant <a for=/>credentials</a> in the request.
 It will also put stricter requirements on the response. Not only will <code>bar.invalid</code> need
 to list `<code>https://foo.invalid</code>` as value for the
 `<a http-header><code>Access-Control-Allow-Origin</code></a>` header (`<code>*</code>` is not
 allowed when <a for=/>credentials</a> are involved), the
 `<a http-header><code>Access-Control-Allow-Credentials</code></a>` header has to be present too:

 <pre><code class=lang-http>
Access-Control-Allow-Origin: https://foo.invalid
Access-Control-Allow-Credentials: true
</code></pre>

 <p>If the response does not include those two headers with those values, the <code>failure</code>
 callback will be invoked. However, any `<code>Set-Cookie</code>` response headers will be
 respected.
</div>


<h4 id=cors-protocol-exceptions>CORS protocol exceptions</h4>

<p>Specifications have allowed limited exceptions to the CORS safelist for non-safelisted
`<code>Content-Type</code>` header values. These exceptions are made for requests that can be
triggered by web content but whose headers and bodies can be only minimally controlled by the web
content. Therefore, servers should expect cross-origin web content to be allowed to trigger
non-preflighted requests with the following non-safelisted `<code>Content-Type</code>` header
values:

<ul class=brief>
 <li>`<code>application/csp-report</code>` [[CSP]]
 <li>`<code>application/expect-ct-report+json</code>` [[RFC9163]]
 <li>`<code>application/xss-auditor-report</code>`
 <li>`<code>application/ocsp-request</code>` [[RFC6960]]
</ul>

<p>Specifications should avoid introducing new exceptions and should only do so with careful
consideration for the security consequences. New exceptions can be proposed by
<a href=https://github.com/whatwg/fetch/issues/new>filing an issue</a>.


<h3 id=content-length-header>`<code>Content-Length</code>` header</h3>

<p>The `<code>Content-Length</code>` header is largely defined in HTTP. Its processing model is
defined here as the model defined in HTTP is not compatible with web content. [[HTTP]]

<div algorithm>
<p>To <dfn export for="header list" lt="extract a length|extracting a length">extract a length</dfn>
from a <a for=/>header list</a> <var>headers</var>, run these steps:

<ol>
 <li><p>Let <var>values</var> be the result of
 <a for="header list">getting, decoding, and splitting</a> `<code>Content-Length</code>` from
 <var>headers</var>.

 <li><p>If <var>values</var> is null, then return null.

 <li><p>Let <var>candidateValue</var> be null.

 <li>
  <p><a for=list>For each</a> <var>value</var> of <var>values</var>:

  <ol>
   <li><p>If <var>candidateValue</var> is null, then set <var>candidateValue</var> to
   <var>value</var>.

   <li><p>Otherwise, if <var>value</var> is not <var>candidateValue</var>, return failure.
  </ol>

 <li><p>If <var>candidateValue</var> is the empty string or has a <a for=/>code point</a> that is
 not an <a for=/>ASCII digit</a>, then return null.

 <li><p>Return <var>candidateValue</var>, interpreted as decimal number.
</ol>
</div>


<h3 id=content-type-header>`<code>Content-Type</code>` header</h3>

<p>The `<code>Content-Type</code>` header is largely defined in HTTP. Its processing model is
defined here as the model defined in HTTP is not compatible with web content. [[HTTP]]

<div algorithm>
<p>To
<dfn export for="header list" lt="extract a MIME type|extracting a MIME type" id=concept-header-extract-mime-type>extract a MIME type</dfn>
from a <a for=/>header list</a> <var>headers</var>, run these steps:

<ol>
 <li><p>Let <var>charset</var> be null.

 <li><p>Let <var>essence</var> be null.

 <li><p>Let <var>mimeType</var> be null.

 <li><p>Let <var>values</var> be the result of
 <a for="header list">getting, decoding, and splitting</a> `<code>Content-Type</code>` from
 <var>headers</var>.

 <li><p>If <var>values</var> is null, then return failure.

 <li>
  <p><a for=list>For each</a> <var>value</var> of <var>values</var>:

  <ol>
   <li><p>Let <var>temporaryMimeType</var> be the result of <a lt="parse a MIME type">parsing</a>
   <var>value</var>.

   <li><p>If <var>temporaryMimeType</var> is failure or its <a for="MIME type">essence</a> is
   "<code>*/*</code>", then <a for=iteration>continue</a>.

   <li><p>Set <var>mimeType</var> to <var>temporaryMimeType</var>.

   <li>
    <p>If <var>mimeType</var>'s <a for="MIME type">essence</a> is not <var>essence</var>, then:

    <ol>
     <li><p>Set <var>charset</var> to null.

     <li><p>If <var>mimeType</var>'s <a for="MIME type">parameters</a>["<code>charset</code>"]
     <a for=map>exists</a>, then set <var>charset</var> to <var>mimeType</var>'s
     <a for="MIME type">parameters</a>["<code>charset</code>"].

     <li><p>Set <var>essence</var> to <var>mimeType</var>'s <a for="MIME type">essence</a>.
    </ol>

   <li><p>Otherwise, if <var>mimeType</var>'s
   <a for="MIME type">parameters</a>["<code>charset</code>"] does not <a for=map>exist</a>, and
   <var>charset</var> is non-null, set <var>mimeType</var>'s
   <a for="MIME type">parameters</a>["<code>charset</code>"] to <var>charset</var>.
  </ol>

 <li><p>If <var>mimeType</var> is null, then return failure.

 <li><p>Return <var>mimeType</var>.
</ol>
</div>

<p class=warning>When <a>extract a MIME type</a> returns failure or a <a for=/>MIME type</a> whose
<a for="MIME type">essence</a> is incorrect for a given format, treat this as a fatal error.
Existing web platform features have not always followed this pattern, which has been a major source
of security vulnerabilities in those features over the years. In contrast, a
<a for=/>MIME type</a>'s <a for="MIME type">parameters</a> can typically be safely ignored.

<div class=example id=example-extract-a-mime-type>
 <p>This is how <a>extract a MIME type</a> functions in practice:

 <table>
  <tr>
   <th>Headers (as on the network)
   <th>Output (<a lt="serialize a MIME type">serialized</a>)
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/plain;charset=gbk, text/html
</code></pre>
   <td><code>text/html</code>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html;charset=gbk;a=b, text/html;x=y
</code></pre>
   <td rowspan=2><code>text/html;x=y;charset=gbk</code>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html;charset=gbk;a=b
Content-Type: text/html;x=y
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html;charset=gbk
Content-Type: x/x
Content-Type: text/html;x=y
</code></pre>
   <td><code>text/html;x=y</code>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html
Content-Type: cannot-parse
</code></pre>
   <td rowspan=3><code>text/html</code>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html
Content-Type: */*
</code></pre>
  <tr>
   <td>
    <pre><code class=lang-http>
Content-Type: text/html
Content-Type:
</code></pre>
 </table>
</div>

<div algorithm>
<p>To <dfn export>legacy extract an encoding</dfn> given failure or a <a for=/>MIME type</a>
<var>mimeType</var> and an <a for=/>encoding</a> <var>fallbackEncoding</var>, run these steps:

<ol>
 <li><p>If <var>mimeType</var> is failure, then return <var>fallbackEncoding</var>.

 <li><p>If <var>mimeType</var>["<code>charset</code>"] does not <a for=map>exist</a>, then return
 <var>fallbackEncoding</var>.

 <li><p>Let <var>tentativeEncoding</var> be the result of <a for=/>getting an encoding</a> from
 <var>mimeType</var>["<code>charset</code>"].

 <li><p>If <var>tentativeEncoding</var> is failure, then return <var>fallbackEncoding</var>.

 <li><p>Return <var>tentativeEncoding</var>.
</ol>

<div class=note>
 <p>This algorithm allows <var>mimeType</var> to be failure so it can be more easily combined with
 <a>extract a MIME type</a>.

 <p>It is denoted as legacy as modern formats are to exclusively use <a for=/>UTF-8</a>.
</div>
</div>


<h3 id=x-content-type-options-header>`<code>X-Content-Type-Options</code>` header</h3>

<p>The
`<dfn export http-header id=http-x-content-type-options><code>X-Content-Type-Options</code></dfn>`
response <a for=/>header</a> can be used to require checking of a <a for=/>response</a>'s
`<code>Content-Type</code>` <a for=/>header</a> against the <a for=request>destination</a> of a
<a for=/>request</a>.

<div algorithm>
<p>To <dfn export>determine nosniff</dfn>, given a <a for=/>header list</a> <var>list</var>, run
these steps:

<ol>
 <li><p>Let <var>values</var> be the result of
 <a for="header list">getting, decoding, and splitting</a>
 `<a http-header><code>X-Content-Type-Options</code></a>` from <var>list</var>.

 <li><p>If <var>values</var> is null, then return false.

 <li><p>If <var>values</var>[0] is an <a>ASCII case-insensitive</a> match for
 "<code>nosniff</code>", then return true.

 <li><p>Return false.
</ol>
</div>

<p>Web developers and conformance checkers must use the following <a for=header>value</a>
<a>ABNF</a> for `<a http-header><code>X-Content-Type-Options</code></a>`:

<pre><code class=lang-abnf>
X-Content-Type-Options           = "nosniff" ; case-insensitive
</code></pre>


<div algorithm="should response to request be blocked due to nosniff">
<h4 lt="should response to request be blocked due to nosniff" dfn id=should-response-to-request-be-blocked-due-to-nosniff?>Should
<var>response</var> to <var>request</var> be blocked due to nosniff?</h4>

<p>Run these steps:

<ol>
 <li><p>If <a>determine nosniff</a> with <var>response</var>'s <a for=response>header list</a> is
 false, then return <b>allowed</b>.

 <li><p>Let <var>mimeType</var> be the result of <a for="header list">extracting a MIME type</a>
 from <var>response</var>'s <a for=response>header list</a>.

 <li><p>Let <var>destination</var> be <var>request</var>'s <a for=request>destination</a>.

 <li><p>If <var>destination</var> is <a for=request/destination>script-like</a> and
 <var>mimeType</var> is failure or is not a <a>JavaScript MIME type</a>, then return <b>blocked</b>.

 <li><p>If <var>destination</var> is "<code>style</code>" and <var>mimeType</var> is failure or its
 <a for="MIME type">essence</a> is not "<code>text/css</code>", then return <b>blocked</b>.

 <li><p>Return <b>allowed</b>.
</ol>

<p class=note>Only <a for=/>request</a> <a for=request>destinations</a> that are
<a for=request/destination>script-like</a> or "<code>style</code>" are considered as any exploits
pertain to them. Also, considering "<code>image</code>" was not compatible with deployed content.
</div>


<h3 id=cross-origin-resource-policy-header>`<code>Cross-Origin-Resource-Policy</code>` header</h3>

<p>The
`<dfn export http-header id=http-cross-origin-resource-policy><code>Cross-Origin-Resource-Policy</code></dfn>`
response <a for=/>header</a> can be used to require checking a <a for=/>request</a>'s
<a for=request>current URL</a>'s <a for=url>origin</a> against a <a for=/>request</a>'s
<a for=request>origin</a> when <a for=/>request</a>'s <a for=request>mode</a> is
"<code>no-cors</code>".

<p>Its <a for=header>value</a> <a>ABNF</a>:

<pre><code class=lang-abnf>
Cross-Origin-Resource-Policy     = %s"same-origin" / %s"same-site" / %s"cross-origin" ; case-sensitive
</code></pre>

<div algorithm>
<p>To perform a <dfn export>cross-origin resource policy check</dfn>, given an <a for=url>origin</a>
<var>origin</var>, an <a for=/>environment settings object</a> <var>settingsObject</var>, a string
<var>destination</var>, a <a for=/>response</a> <var>response</var>, and an optional boolean
<var>forNavigation</var>, run these steps:

<ol>
 <li><p>Set <var>forNavigation</var> to false if it is not given.

 <li><p>Let <var>embedderPolicy</var> be <var>settingsObject</var>'s
 <a for="environment settings object">policy container</a>'s
 <a for="policy container">embedder policy</a>.

 <li>
  <p>If the <a>cross-origin resource policy internal check</a> with <var>origin</var>,
  "<a for="embedder policy value"><code>unsafe-none</code></a>", <var>response</var>, and
  <var>forNavigation</var> returns <b>blocked</b>, then return <b>blocked</b>.

  <p class="note">This step is needed because we don't want to report violations not related to
  Cross-Origin Embedder Policy below.

 <li><p>If the <a>cross-origin resource policy internal check</a> with <var>origin</var>,
 <var>embedderPolicy</var>'s <a for="embedder policy">report only value</a>, <var>response</var>,
 and <var>forNavigation</var> returns <b>blocked</b>, then
 <a>queue a cross-origin embedder policy CORP violation report</a> with <var>response</var>,
 <var>settingsObject</var>, <var>destination</var>, and true.

 <li><p>If the <a>cross-origin resource policy internal check</a> with <var>origin</var>,
 <var>embedderPolicy</var>'s <a for="embedder policy">value</a>, <var>response</var>, and
 <var>forNavigation</var> returns <b>allowed</b>, then return <b>allowed</b>.

 <li><p><a>Queue a cross-origin embedder policy CORP violation report</a> with <var>response</var>,
 <var>settingsObject</var>, <var>destination</var>, and false.

 <li><p>Return <b>blocked</b>.
</ol>

<p class=note>Only HTML's navigate algorithm uses this check with <var>forNavigation</var> set to
true, and it's always for nested navigations. Otherwise, <var>response</var> is either the
<a for="filtered response">internal response</a> of an <a>opaque filtered response</a> or a
<a for=/>response</a> which will be the <a for="filtered response">internal response</a> of an
<a>opaque filtered response</a>. [[HTML]]
</div>

<div algorithm>
<p>To perform a <dfn>cross-origin resource policy internal check</dfn>, given an
<a for=url>origin</a> <var>origin</var>, an <a for=/>embedder policy value</a>
<var>embedderPolicyValue</var>, a <a for=/>response</a> <var>response</var>, and a boolean
<var>forNavigation</var>, run these steps:

<ol>
 <li><p>If <var>forNavigation</var> is true and <var>embedderPolicyValue</var> is
 "<a for="embedder policy value"><code>unsafe-none</code></a>", then return <b>allowed</b>.

 <li>
  <p>Let <var>policy</var> be the result of <a for="header list">getting</a>
  `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` from <var>response</var>'s
  <a for=response>header list</a>.

  <p class=note>This means that `<code>Cross-Origin-Resource-Policy: same-site, same-origin</code>`
  ends up as <b>allowed</b> below as it will never match anything, as long as
  <var>embedderPolicyValue</var> is "<a for="embedder policy value"><code>unsafe-none</code></a>".
  Two or more `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` headers will have the
  same effect.

 <li><p>If <var>policy</var> is neither `<code>same-origin</code>`, `<code>same-site</code>`, nor
 `<code>cross-origin</code>`, then set <var>policy</var> to null.

 <li>
  <p>If <var>policy</var> is null, then switch on <var>embedderPolicyValue</var>:</p>

  <dl class=switch>
   <dt>"<a for="embedder policy value"><code>unsafe-none</code></a>"
   <dd><p>Do nothing.

   <dt>"<a for="embedder policy value"><code>credentialless</code></a>"
   <dd>
    <p>Set <var>policy</var> to `<code>same-origin</code>` if:

    <ul>
     <li><var>response</var>'s <a for="response">request-includes-credentials</a> is true, or
     <li><var>forNavigation</var> is true.
    </ul>

   <dt>"<a for="embedder policy value"><code>require-corp</code></a>"
   <dd><p>Set <var>policy</var> to `<code>same-origin</code>`.
  </dl>
 </li>

 <li>
  <p>Switch on <var>policy</var>:

  <dl class=switch>
   <dt>null
   <dt>`<code>cross-origin</code>`
   <dd><p>Return <b>allowed</b>.

   <dt>`<code>same-origin</code>`
   <dd>
    <p>If <var>origin</var> is <a>same origin</a> with <var>response</var>'s <a for=response>URL</a>'s
    <a for=url>origin</a>, then return <b>allowed</b>.

    <p>Otherwise, return <b>blocked</b>.

   <dt>`<code>same-site</code>`
   <dd>
    <p>If all of the following are true

    <ul class=brief>
     <li><p><var>origin</var> is <a>schemelessly same site</a> with <var>response</var>'s
     <a for=response>URL</a>'s <a for=url>origin</a>

     <li><p><var>origin</var>'s <a for=url>scheme</a> is "<code>https</code>" or
     <var>response</var>'s <a for=response>URL</a>'s <a for=url>scheme</a> is not
     "<code>https</code>"
    </ul>

    <p>then return <b>allowed</b>.

    <p>Otherwise, return <b>blocked</b>.

    <p class=note>`<code>Cross-Origin-Resource-Policy: same-site</code>` does not consider a
    response delivered via a secure transport to match a non-secure requesting origin,
    even if their hosts are otherwise same site. Securely-transported responses will only
    match a securely-transported initiator.
  </dl>
</ol>
</div>

<div algorithm>
<p>To <dfn>queue a cross-origin embedder policy CORP violation report</dfn>, given a
<a for=/>response</a> <var>response</var>, an <a for=/>environment settings object</a>
<var>settingsObject</var>, a string <var>destination</var>, and a boolean <var>reportOnly</var>,
run these steps:

<ol>
 <li><p>Let <var>endpoint</var> be <var>settingsObject</var>'s
 <a for="environment settings object">policy container</a>'s
 <a for="policy container">embedder policy</a>'s
 <a for="embedder policy">report only reporting endpoint</a> if <var>reportOnly</var> is true and
 <var>settingsObject</var>'s <a for="environment settings object">policy container</a>'s
 <a for="policy container">embedder policy</a>'s
 <a for="embedder policy">reporting endpoint</a> otherwise.

 <li><p>Let <var>serializedURL</var> be the result of
 <a lt="serialize a response URL for reporting">serializing a response URL for reporting</a> with
 <var>response</var>.

 <li><p>Let <var>disposition</var> be "<code>reporting</code>" if <var>reportOnly</var> is true;
 otherwise "<code>enforce</code>".

 <li>
  <p>Let <var>body</var> be a new object containing the following properties:

  <table>
   <thead>
    <th>key
    <th>value
   </thead>
   <tbody>
    <tr>
     <td>"<code>type</code>"
     <td>"<code>corp</code>"
    </tr>
    <tr>
     <td>"<code>blockedURL</code>"
     <td><var>serializedURL</var>
    </tr>
    <tr>
     <td>"<code>destination</code>"
     <td><var>destination</var>
    </tr>
    <tr>
     <td>"<code>disposition</code>"
     <td><var>disposition</var>
    </tr>
   </tbody>
  </table>

 <li><p><a>Generate and queue a report</a> for <var>settingsObject</var>'s
 <a for="environment settings object">global object</a> given the
 <a>"<code>coep</code>" report type</a>, <var>endpoint</var>, and <var>body</var>. [[!REPORTING]]
</ol>
</div>


<h3 id="sec-purpose-header">`<code>Sec-Purpose</code>` header</h3>

<p>The `<dfn export http-header id=http-sec-purpose><code>Sec-Purpose</code></dfn>` HTTP request
header specifies that the request serves one or more purposes other than requesting the resource for
immediate use by the user.

<p>The `<a http-header><code>Sec-Purpose</code></a>` header field is a <a>structured header</a>
whose value must be a <a data-lt="structured field token">token</a>.

<p>The sole <a data-lt="structured field token">token</a> defined is <code>prefetch</code>. It
indicates the request’s purpose is to fetch a resource that is anticipated to be needed shortly.

<p class=note>The server can use this to adjust the caching expiry for prefetches, to disallow the
prefetch, or to treat it differently when counting page visits.



<h2 id=fetching>Fetching</h2>

<p class=note>The algorithm below defines <a lt=fetch for=/>fetching</a>. In broad strokes, it takes
a <a for=/>request</a> and one or more algorithms to run at various points during the operation. A
<a for=/>response</a> is passed to the last two algorithms listed below. The first two algorithms
can be used to capture uploads.

<div algorithm="fetch">
<p>To <dfn export id=concept-fetch>fetch</dfn>, given a <a for=/>request</a> <var>request</var>, an
optional algorithm
<dfn export for=fetch id=process-request-body><var>processRequestBodyChunkLength</var></dfn>, an
optional algorithm
<dfn export for=fetch id=process-request-end-of-body oldids=process-request-end-of-file><var>processRequestEndOfBody</var></dfn>,
an optional algorithm <dfn export for=fetch><var>processEarlyHintsResponse</var></dfn>, an optional
algorithm <dfn export for=fetch id=process-response><var>processResponse</var></dfn>, an optional
algorithm <dfn export for=fetch><var>processResponseEndOfBody</var></dfn>, an optional algorithm
<dfn export for=fetch id=process-response-end-of-body oldids=process-response-end-of-file><var>processResponseConsumeBody</var></dfn>,
and an optional boolean <dfn export for=fetch><var>useParallelQueue</var></dfn> (default false), run
the steps below. If given, <var>processRequestBodyChunkLength</var> must be an algorithm accepting
an integer representing the number of bytes transmitted. If given,
<var>processRequestEndOfBody</var> must be an algorithm accepting no arguments. If given,
<var>processEarlyHintsResponse</var> must be an algorithm accepting a <a for=/>response</a>. If
given, <var>processResponse</var> must be an algorithm accepting a <a for=/>response</a>. If given,
<var>processResponseEndOfBody</var> must be an algorithm accepting a <a for=/>response</a>. If
given, <var>processResponseConsumeBody</var> must be an algorithm accepting a <a for=/>response</a>
and null, failure, or a <a for=/>byte sequence</a>.

<p>The user agent may be asked to
<dfn export for=fetch id=concept-fetch-suspend>suspend</dfn> the ongoing fetch.
The user agent may either accept or ignore the suspension request. The suspended fetch can be
<dfn export for=fetch id=concept-fetch-resume>resumed</dfn>. The user agent should
ignore the suspension request if the ongoing fetch is updating the response in the HTTP cache for
the request.

<p class=note>The user agent does not update the entry in the HTTP cache for a <a for=/>request</a>
if request's cache mode is "no-store" or a `<code>Cache-Control: no-store</code>` header appears in
the response. [[!HTTP-CACHING]]

<ol>
 <li>
  <p><a for=/>Assert</a>: <var>request</var>'s <a for=request>mode</a> is "<code>navigate</code>" or
  <var>processEarlyHintsResponse</var> is null.

  <p class=note>Processing of early hints (<a for=/>responses</a> whose <a for=response>status</a>
  is 103) is only vetted for navigations.

 <li><p>Let <var>taskDestination</var> be null.

 <li><p>Let <var>crossOriginIsolatedCapability</var> be false.

 <li>
  <p>If <var>request</var>'s <a for=request>client</a> is non-null, then:

  <ol>
   <li><p>Set <var>taskDestination</var> to <var>request</var>'s <a for=request>client</a>'s
   <a for="environment settings object">global object</a>.

   <li><p>Set <var>crossOriginIsolatedCapability</var> to <var>request</var>'s
   <a for=request>client</a>'s
   <a for="environment settings object">cross-origin isolated capability</a>.
  </ol>

 <li><p>If <var>useParallelQueue</var> is true, then set <var>taskDestination</var> to the result of
 <a>starting a new parallel queue</a>.

 <!-- It would be nice to assert that taskDestination is non-null here, but it's not clear if this
      works for all callers. Fetch itself calls main fetch while taskDestination is null. Anyone
      wanting to do a ping without request body might do so as well, but if you do have a request
      body you definitely need this as otherwise transmit-request-body loop breaks down. -->

 <li><p>Let <var>timingInfo</var> be a new <a for=/>fetch timing info</a> whose
 <a for="fetch timing info">start time</a> and
 <a for="fetch timing info">post-redirect start time</a> are the
 <a for=/>coarsened shared current time</a> given <var>crossOriginIsolatedCapability</var>, and
 <a for="fetch timing info">render-blocking</a> is set to <var>request</var>'s
 <a for=request>render-blocking</a>.

 <li><p>Let <var>fetchParams</var> be a new <a for=/>fetch params</a> whose
 <a for="fetch params">request</a> is <var>request</var>,
 <a for="fetch params">timing info</a> is <var>timingInfo</var>,
 <a for="fetch params">process request body chunk length</a> is
 <var>processRequestBodyChunkLength</var>,
 <a for="fetch params">process request end-of-body</a> is <var>processRequestEndOfBody</var>,
 <a for="fetch params">process early hints response</a> is <var>processEarlyHintsResponse</var>,
 <a for="fetch params">process response</a> is <var>processResponse</var>,
 <a for="fetch params">process response consume body</a> is <var>processResponseConsumeBody</var>,
 <a for="fetch params">process response end-of-body</a> is <var>processResponseEndOfBody</var>,
 <a for="fetch params">task destination</a> is <var>taskDestination</var>, and
 <a for="fetch params">cross-origin isolated capability</a> is
 <var>crossOriginIsolatedCapability</var>.

 <li><p>If <var>request</var>'s <a for=request>body</a> is a <a for=/>byte sequence</a>, then set
 <var>request</var>'s <a for=request>body</a> to <var>request</var>'s <a for=request>body</a>
 <a for="byte sequence">as a body</a>.

 <li><p>If <var>request</var>'s <a for=request>window</a> is "<code>client</code>", then set
 <var>request</var>'s <a for=request>window</a> to <var>request</var>'s <a for=request>client</a>,
 if <var>request</var>'s <a for=request>client</a>'s
 <a for="environment settings object">global object</a> is a {{Window}} object; otherwise
 "<code>no-window</code>".

 <li><p>If <var>request</var>'s <a for=request>origin</a> is "<code>client</code>", then set
 <var>request</var>'s <a for=request>origin</a> to  <var>request</var>'s <a for=request>client</a>'s
 <a for="environment settings object">origin</a>.

 <li>
  <p>If all of the following conditions are true:

  <ul class=brief>
   <li><p><var>request</var>'s <a for=request>URL</a>'s <a for=url>scheme</a> is an
   <a>HTTP(S) scheme</a>

   <li><p><var>request</var>'s <a for=request>mode</a> is "<code>same-origin</code>",
   "<code>cors</code>", or "<code>no-cors</code>"

   <li><p><var>request</var>'s <a for=request>window</a> is non-null

   <li><p><var>request</var>'s <a for=request>method</a> is `<code>GET</code>`

   <li><p><var>request</var>'s <a for=request>unsafe-request flag</a> is not set or
   <var>request</var>'s <a for=request>header list</a> <a for="list">is empty</a>
  </ul>

  <p>then:

  <ol>
   <li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>origin</a> is <a>same origin</a>
   with <var>request</var>'s <a for=request>client</a>'s
   <a for="environment settings object">origin</a>.

   <li><p>Let <var>onPreloadedResponseAvailable</var> be an algorithm that runs the following
   step given a <a for=/>response</a> <var>response</var>: set <var>fetchParams</var>'s
   <a for="fetch params">preloaded response candidate</a> to <var>response</var>.

   <li><p>Let <var>foundPreloadedResource</var> be the result of invoking
   <a>consume a preloaded resource</a> for <var>request</var>'s <a for=request>window</a>, given
   <var>request</var>'s <a for=request>URL</a>, <var>request</var>'s <a for=request>destination</a>,
   <var>request</var>'s <a for=request>mode</a>, <var>request</var>'s
   <a for=request>credentials mode</a>, <var>request</var>'s <a for=request>integrity metadata</a>,
   and <var>onPreloadedResponseAvailable</var>.

   <li><p>If <var>foundPreloadedResource</var> is true and <var>fetchParams</var>'s
   <a for="fetch params">preloaded response candidate</a> is null, then set <var>fetchParams</var>'s
   <a for="fetch params">preloaded response candidate</a> to "<code>pending</code>".
  </ol>
 </li>

 <li>
  <p>If <var>request</var>'s <a for=request>policy container</a> is "<code>client</code>", then:

  <ol>
   <li><p>If <var>request</var>'s <a for=request>client</a> is non-null, then set
   <var>request</var>'s <a for=request>policy container</a> to a
   <a lt="clone a policy container">clone</a> of <var>request</var>'s <a for=request>client</a>'s
   <a for="environment settings object">policy container</a>. [[!HTML]]

   <li><p>Otherwise, set <var>request</var>'s <a for=request>policy container</a> to a new
   <a for=/>policy container</a>.
  </ol>

 <li>
  <p>If <var>request</var>'s <a for=request>header list</a>
  <a for="header list">does not contain</a> `<code>Accept</code>`, then:

  <ol>
   <li><p>Let <var>value</var> be `<code>*/*</code>`.

   <li><p>If <var>request</var>'s <a for=request>initiator</a> is "<code>prefetch</code>", then set
   <var>value</var> to the <a>document `<code>Accept</code>` header value</a>.

   <li>
    <p>Otherwise, the user agent should set <var>value</var> to the first matching statement, if
    any, switching on <var>request</var>'s <a for=request>destination</a>:
    <!-- https://github.com/whatwg/fetch/issues/43#issuecomment-97909717 -->

    <dl class=switch>
     <dt>"<code>document</code>"
     <dt>"<code>frame</code>"
     <dt>"<code>iframe</code>"
     <dd>the <a>document `<code>Accept</code>` header value</a>

     <dt>"<code>image</code>"
     <dd>`<code>image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5</code>`

     <dt>"<code>style</code>"
     <dd>`<code>text/css,*/*;q=0.1</code>`
    </dl>

   <li><p><a for="header list">Append</a> (`<code>Accept</code>`, <var>value</var>) to
   <var>request</var>'s <a for=request>header list</a>.
  </ol>

 <li><p>If <var>request</var>'s <a for=request>header list</a>
 <a for="header list">does not contain</a> `<code>Accept-Language</code>`, then user agents should
 <a for="header list">append</a> (`<code>Accept-Language</code>, an appropriate
 <a for=/>header value</a>) to <var>request</var>'s <a for=request>header list</a>.

 <li>
  <p>If <var>request</var>'s <a for=request>internal priority</a> is null, then use
  <var>request</var>'s <a for=request>priority</a>, <a for=request>initiator</a>,
  <a for=request>destination</a>, and <a for=request>render-blocking</a> in an
  <a>implementation-defined</a> manner to set <var>request</var>'s
  <a for=request>internal priority</a> to an <a>implementation-defined</a> object.

  <p class=note>The <a>implementation-defined</a> object could encompass stream weight and
  dependency for HTTP/2, priorities used in <cite>Extensible Prioritization Scheme for HTTP</cite>
  for transports where it applies (including HTTP/3), and equivalent information used to prioritize
  dispatch and processing of HTTP/1 fetches. [[!RFC9218]]

 <li>
  <p>If <var>request</var> is a <a>subresource request</a>, then:

  <ol>
   <li><p>Let <var>record</var> be a new <a for="fetch group">fetch record</a> whose
   <a for="fetch record">request</a> is <var>request</var> and <a for="fetch record">controller</a>
   is <var>fetchParams</var>'s <a for="fetch params">controller</a>.

   <li><p>Append <var>record</var> to <var>request</var>'s <a for=request>client</a>'s
   <a for=fetch>fetch group</a> list of <a for="fetch group">fetch records</a>.
  </ol>

 <li><p>Run <a>main fetch</a> given <var>fetchParams</var>.

 <li><p>Return <var>fetchParams</var>'s <a for="fetch params">controller</a>.
</ol>
</div>


<h3 id=main-fetch>Main fetch</h3>

<div algorithm>
<p>To <dfn id=concept-main-fetch>main fetch</dfn>, given a <a for=/>fetch params</a>
<var>fetchParams</var> and an optional boolean <var>recursive</var> (default false), run these
steps:

<ol>
 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li><p>Let <var>response</var> be null.

 <li><p>If <var>request</var>'s <a>local-URLs-only flag</a> is set and <var>request</var>'s
 <a for=request>current URL</a> is not <a lt="is local">local</a>, then set <var>response</var> to a
 <a>network error</a>.

 <li><p>Run <a>report Content Security Policy violations for <var>request</var></a>.

 <li><p><a>Upgrade <var>request</var> to a potentially trustworthy URL, if appropriate</a>.

 <li><p><a>Upgrade a mixed content <var>request</var> to a potentially trustworthy URL, if appropriate</a>.

 <li><p>If <a lt="block bad port">should <var>request</var> be blocked due to a bad port</a>,
 <a lt="should fetching request be blocked as mixed content?">should fetching <var>request</var> be blocked as mixed content</a>, or
 <a lt="should request be blocked by Content Security Policy?">should <var>request</var> be blocked by Content Security Policy</a>
 returns <b>blocked</b>, then set <var>response</var> to a <a>network error</a>.

 <li><p>If <var>request</var>'s <a for=request>referrer policy</a> is the empty string, then set
 <var>request</var>'s <a for=request>referrer policy</a> to <var>request</var>'s
 <a for=request>policy container</a>'s <a for="policy container">referrer policy</a>.

 <li>
  <p>If <var>request</var>'s <a for=request>referrer</a> is not "<code>no-referrer</code>", then set
  <var>request</var>'s <a for=request>referrer</a> to the result of invoking
  <a>determine <var>request</var>'s referrer</a>. [[!REFERRER]]

  <p class=note>As stated in <cite>Referrer Policy</cite>, user agents can provide the end user with
  options to override <var>request</var>'s <a for=request>referrer</a> to "<code>no-referrer</code>"
  or have it expose less sensitive information.

 <li>
  <p>Set <var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> to
  "<code>https</code>" if all of the following conditions are true:

  <ul class=brief>
   <li><var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> is
   "<code>http</code>"
   <li><var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a> is a
   <a for=/>domain</a>
   <li>Matching <var>request</var>'s <a for=request>current URL</a>'s <a for=url>host</a> per
   <a href=https://www.rfc-editor.org/rfc/rfc6797.html#section-8.2>Known HSTS Host Domain Name Matching</a>
   results in either a superdomain match with an asserted <code>includeSubDomains</code> directive
   or a congruent match (with or without an asserted <code>includeSubDomains</code> directive) [[!HSTS]]; or
   DNS resolution for the request finds a matching HTTPS RR per
   <a href=https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https#section-9.5>section 9.5</a>
   of [[!SVCB]].
   [[!HSTS]] [[!SVCB]]
  </ul>
  <!-- Per Mike West HSTS happens "probably after" Referrer -->

  <p class=note>As all DNS operations are generally <a>implementation-defined</a>, how it is
  determined that DNS resolution contains an HTTPS RR is also <a>implementation-defined</a>. As DNS
  operations are not traditionally performed until attempting to <a>obtain a connection</a>, user
  agents might need to perform DNS operations earlier, consult local DNS caches, or wait until later
  in the fetch algorithm and potentially unwind logic on discovering the need to change
  <var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a>.

 <li><p>If <var>recursive</var> is false, then run the remaining steps <a>in parallel</a>.

 <li>
  <p>If <var>response</var> is null, then set <var>response</var> to the result of running the steps
  corresponding to the first matching statement:

  <dl class=switch>
   <dt><var>fetchParams</var>'s <a for="fetch params">preloaded response candidate</a> is non-null
   <dd>
    <ol>
     <li><p>Wait until <var>fetchParams</var>'s
     <a for="fetch params">preloaded response candidate</a> is not "<code>pending</code>".

     <li><p><a for=/>Assert</a>: <var>fetchParams</var>'s
     <a for="fetch params">preloaded response candidate</a> is a <a for=/>response</a>.

     <li><p>Return <var>fetchParams</var>'s <a for="fetch params">preloaded response candidate</a>.
    </ol>

   <dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> is
   <a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, and <var>request</var>'s
   <a for=request>response tainting</a> is "<code>basic</code>"
   <dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> is
   "<code>data</code>"
   <dt><var>request</var>'s <a for=request>mode</a> is
   "<code>navigate</code>" or "<code>websocket</code>"
   <dd>
    <ol>
     <li><p>Set <var>request</var>'s
     <a for=request>response tainting</a> to "<code>basic</code>".

     <li><p>Return the result of running <a>scheme fetch</a> given <var>fetchParams</var>.
    </ol>

    <p class=note>HTML assigns any documents and workers created from <a for=/>URLs</a> whose
    <a for=url>scheme</a> is "<code>data</code>" a unique <a>opaque origin</a>. Service workers can
    only be created from <a for=/>URLs</a> whose <a for=url>scheme</a> is an <a>HTTP(S) scheme</a>.
    [[!HTML]] [[!SW]]

   <dt><var>request</var>'s <a for=request>mode</a> is "<code>same-origin</code>"
   <dd><p>Return a <a>network error</a>.

   <dt><var>request</var>'s <a for=request>mode</a> is "<code>no-cors</code>"
   <dd>
    <ol>
     <li><p>If <var>request</var>'s <a for=request>redirect mode</a> is not "<code>follow</code>",
     then return a <a>network error</a>.

     <li><p>Set <var>request</var>'s <a for=request>response tainting</a> to "<code>opaque</code>".

     <li><p>Return the result of running <a>scheme fetch</a> given <var>fetchParams</var>.
     <!-- file URLs end up here as they are not same-origin typically. -->
    </ol>

   <dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> is not an
   <a>HTTP(S) scheme</a>
   <dd><p>Return a <a>network error</a>.

   <dt><var>request</var>'s <a>use-CORS-preflight flag</a> is set
   <dt><var>request</var>'s <a>unsafe-request flag</a> is set and either <var>request</var>'s
   <a for=request>method</a> is not a <a>CORS-safelisted method</a> or
   <a>CORS-unsafe request-header names</a> with <var>request</var>'s <a for=request>header list</a>
   <a for=list>is not empty</a>
   <dd>
    <ol>
     <li><p>Set <var>request</var>'s
     <a for=request>response tainting</a> to
     "<code>cors</code>".

     <li><p>Let <var>corsWithPreflightResponse</var> be the result of running <a>HTTP fetch</a>
     given <var>fetchParams</var> and true.

     <li><p>If <var>corsWithPreflightResponse</var> is a <a>network error</a>, then
     <a>clear cache entries</a> using <var>request</var>.

     <li><p>Return <var>corsWithPreflightResponse</var>.
    </ol>

   <dt>Otherwise
   <dd>
    <ol>
     <li><p>Set <var>request</var>'s
     <a for=request>response tainting</a> to
     "<code>cors</code>".

     <li><p>Return the result of running <a>HTTP fetch</a> given <var>fetchParams</var>.
    </ol>
  </dl>

 <li><p>If <var>recursive</var> is true, then return <var>response</var>.

 <li>
  <p>If <var>response</var> is not a <a>network error</a> and <var>response</var> is not a
  <a>filtered response</a>, then:

  <ol>
   <li>
    <p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>cors</code>", then:

    <ol>
     <li><p>Let <var>headerNames</var> be the result of <a>extracting header list values</a> given
     `<a http-header><code>Access-Control-Expose-Headers</code></a>` and <var>response</var>'s
     <a for=response>header list</a>.

     <li><p>If <var>request</var>'s <a for=request>credentials mode</a> is not
     "<code>include</code>" and <var>headerNames</var> contains `<code>*</code>`, then set
     <var>response</var>'s <a for=response>CORS-exposed header-name list</a> to all unique
     <a for=/>header</a> <a lt=name for=header>names</a> in <var>response</var>'s
     <a for=response>header list</a>.

     <li>
      <p>Otherwise, if <var>headerNames</var> is non-null or failure, then set <var>response</var>'s
      <a for=response>CORS-exposed header-name list</a> to <var>headerNames</var>.

      <p class="note">One of the <var>headerNames</var> can still be `<code>*</code>` at this point,
      but will only match a <a for=/>header</a> whose <a for=header>name</a> is `<code>*</code>`.
    </ol>

   <li>
    <p>Set <var>response</var> to the following <a>filtered response</a> with <var>response</var> as
    its <a for="filtered response">internal response</a>, depending on <var>request</var>'s
    <a for=request>response tainting</a>:

    <dl class="switch compact">
     <dt>"<code>basic</code>"
     <dd><a>basic filtered response</a>
     <dt>"<code>cors</code>"
     <dd><a>CORS filtered response</a>
     <dt>"<code>opaque</code>"
     <dd><a>opaque filtered response</a>
    </dl>
  </ol>

 <li><p>Let <var>internalResponse</var> be <var>response</var>, if <var>response</var> is a
 <a>network error</a>, and <var>response</var>'s <a for="filtered response">internal response</a>
 otherwise.

 <li>
  <p>If <var>internalResponse</var>'s <a for=response>URL list</a> <a for=list>is empty</a>, then
  set it to a <a for=list>clone</a> of <var>request</var>'s <a for=request>URL list</a>.

  <p class=note>A <a for=/>response</a>'s <a for=response>URL list</a> can be empty (for example,
  when the response represents an <code>about</code> URL).
 <!-- If you are ever tempted to move this around, carefully consider responses from about URLs,
      blob URLs, service workers, HTTP cache, HTTP network, etc. -->

 <li><p>If <var>request</var> has a <a for=request>redirect-tainted origin</a>, then set
 <var>internalResponse</var>'s <a for=response>has-cross-origin-redirects</a> to true.

 <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is unset, then set
 <var>internalResponse</var>'s <a for=response>timing allow passed flag</a>.

 <li>
  <p>If <var>response</var> is not a <a>network error</a> and any of the following returns
  <b>blocked</b>

  <ul class=brief>
   <li><p><a lt="should response to request be blocked as mixed content?">should <var>internalResponse</var> to <var>request</var> be blocked as mixed content</a>

   <li><p><a lt="Should response to request be blocked by Content Security Policy?">should <var>internalResponse</var> to <var>request</var> be blocked by Content Security Policy</a>

   <li><p><a lt="should response to request be blocked due to mime type">should <var>internalResponse</var> to <var>request</var> be blocked due to its MIME type</a>

   <li><p><a lt="should response to request be blocked due to nosniff">should <var>internalResponse</var> to <var>request</var> be blocked due to nosniff</a>
  </ul>

  <p>then set <var>response</var> and <var>internalResponse</var> to a <a>network error</a>.

 <li>
  <p>If <var>response</var>'s <a for=response>type</a> is "<code>opaque</code>",
  <var>internalResponse</var>'s <a for=response>status</a> is 206, <var>internalResponse</var>'s
  <a for=response>range-requested flag</a> is set, and <var>request</var>'s
  <a for=request>header list</a> <a for="header list">does not contain</a> `<code>Range</code>`,
  then set <var>response</var> and <var>internalResponse</var> to a <a>network error</a>.

  <div class=note>
   <p>Traditionally, APIs accept a ranged response even if a range was not requested. This prevents
   a partial response from an earlier ranged request being provided to an API that did not make a
   range request.

   <details>
    <summary>Further details</summary>

    <p>The above steps prevent the following attack:

    <p>A media element is used to request a range of a cross-origin HTML resource. Although this is
    invalid media, a reference to a clone of the response can be retained in a service worker. This
    can later be used as the response to a script element's fetch. If the partial response is valid
    JavaScript (even though the whole resource is not), executing it would leak private data.
   </details>
  </div>

 <li>
  <p>If <var>response</var> is not a <a>network error</a> and
  either <var>request</var>'s <a for=request>method</a> is
  `<code>HEAD</code>` or `<code>CONNECT</code>`, or <var>internalResponse</var>'s
  <a for=response>status</a> is a <a>null body status</a>,
  set <var>internalResponse</var>'s <a for=response>body</a> to
  null and disregard any enqueuing toward it (if any).

  <p class=note>This standardizes the error handling for servers that violate HTTP.

 <li>
  <p>If <var>request</var>'s <a for=request>integrity metadata</a> is not the empty string, then:

  <ol>
   <li><p>Let <var>processBodyError</var> be this step: run <a>fetch response handover</a> given
   <var>fetchParams</var> and a <a>network error</a>.

   <li><p>If <var>response</var>'s <a for=response>body</a> is null, then run
   <var>processBodyError</var> and abort these steps.

   <li>
    <p>Let <var>processBody</var> given <var>bytes</var> be these steps:

    <ol>
     <li><p>If <var>bytes</var> do not <a lt="Do bytes match metadataList?">match</a>
     <var>request</var>'s <a for=request>integrity metadata</a>, then run
     <var>processBodyError</var> and abort these steps. [[!SRI]]

     <li><p>Set <var>response</var>'s <a for=response>body</a> to <var>bytes</var>
     <a for="byte sequence">as a body</a>.

     <li><p>Run <a>fetch response handover</a> given <var>fetchParams</var> and <var>response</var>.
    </ol>

   <li><p><a for=body>Fully read</a> <var>response</var>'s <a for=response>body</a> given
   <var>processBody</var> and <var>processBodyError</var>.
  </ol>

 <li><p>Otherwise, run <a>fetch response handover</a> given <var>fetchParams</var> and
 <var>response</var>.
</ol>
</div>

<hr>

<div algorithm>
<p>The <dfn id=fetch-finale>fetch response handover</dfn>, given a <a for=/>fetch params</a>
<var>fetchParams</var> and a <a for=/>response</a> <var>response</var>, run these steps:

<ol>
 <li><p>Let <var>timingInfo</var> be <var>fetchParams</var>'s
 <a for="fetch params">timing info</a>.

 <li>
  <p>If <var>response</var> is not a <a>network error</a>  and <var>fetchParams</var>'s
  <a for="fetch params">request</a>'s <a for=request>client</a> is a <a>secure context</a>, then set
  <var>timingInfo</var>'s <a for="fetch timing info">server-timing headers</a> to the
  result of <a for="header list">getting, decoding, and splitting</a> `<code>Server-Timing</code>`
  from <var>response</var>'s <a for="filtered response">internal response</a>'s
  <a for=response>header list</a>.

  <p class=note>Using _response_'s <a for="filtered response">internal response</a> is safe as
  exposing `<code>Server-Timing</code>` header data is guarded through the
  `<code>Timing-Allow-Origin</code>` header.

  <p>The user agent may decide to expose `<code>Server-Timing</code>` headers to non-secure contexts
  requests as well.

 <li>
  <p>Let <var>processResponseEndOfBody</var> be the following steps:

  <ol>
   <li><p>Let <var>unsafeEndTime</var> be the <a>unsafe shared current time</a>.

   <li><p>If <var>fetchParams</var>'s <a for="fetch params">request</a>'s
   <a for=request>destination</a> is "<code>document</code>", then set <var>fetchParams</var>'s
   <a for="fetch params">controller</a>'s <a for="fetch controller">full timing info</a> to
   <var>fetchParams</var>'s <a for="fetch params">timing info</a>.

   <li>
    <p>Set <var>fetchParams</var>'s <a for="fetch params">controller</a>'s
    <a for="fetch controller">report timing steps</a> to the following steps given a
    <a for=/>global object</a> <var>global</var>:

    <ol>
     <li><p>If <var>fetchParams</var>'s <a for="fetch params">request</a>'s <a for=request>URL</a>'s
     <a for=url>scheme</a> is not an <a>HTTP(S) scheme</a>, then return.

     <li><p>Set <var>timingInfo</var>'s <a for="fetch timing info">end time</a> to the
     <a>relative high resolution time</a> given <var>unsafeEndTime</var> and
     <var>global</var>.

     <li><p>Let <var>cacheState</var> be <var>response</var>'s <a for=response>cache state</a>.

     <li><p>Let <var>bodyInfo</var> be <var>response</var>'s <a for=response>body info</a>.

     <li>
      <p>If <var>response</var>'s <a for=response>timing allow passed flag</a> is not set,
      then set <var>timingInfo</var> to the result of <a>creating an opaque timing info</a> for
      <var>timingInfo</var> and set <var>cacheState</var> to the empty string.

      <p class=note>This covers the case of <var>response</var> being a <a>network error</a>.

     <li><p>Let <var>responseStatus</var> be 0 if <var>fetchParams</var>'s
     <a for="fetch params">request</a>'s <a for=request>mode</a> is "<code>navigate</code>" and
     <var>response</var>'s <a for=response>has-cross-origin-redirects</a> is true; otherwise
     <var>response</var>'s <a for=response>status</a>.

     <li><p>If <var>fetchParams</var>'s <a for="fetch params">request</a>'s
     <a for=request>initiator type</a> is non-null, then <a for=/>mark resource timing</a> given
     <var>timingInfo</var>, <var>fetchParams</var>'s <a for="fetch params">request</a>'s
     <a for=request>URL</a>, <var>fetchParams</var>'s <a for="fetch params">request</a>'s
     <a for=request>initiator type</a>, <var>global</var>, <var>cacheState</var>,
     <var>bodyInfo</var>, and <var>responseStatus</var>.
    </ol>

   <li>
    <p>Let <var>processResponseEndOfBodyTask</var> be the following steps:

    <ol>
     <li><p>Set <var>fetchParams</var>'s <a for="fetch params">request</a>'s
     <a for=request>done flag</a>.

     <li><p>If <var>fetchParams</var>'s <a for="fetch params">process response end-of-body</a> is
     non-null, then run <var>fetchParams</var>'s
     <a for="fetch params">process response end-of-body</a> given <var>response</var>.

     <li><p>If <var>fetchParams</var>'s <a for="fetch params">request</a>'s
     <a for="request">initiator type</a> is non-null and <var>fetchParams</var>'s
     <a for="fetch params">request</a>'s <a for=request>client</a>'s
     <a for="environment settings object">global object</a> is <var>fetchParams</var>'s
     <a for="fetch params">task destination</a>, then run <var>fetchParams</var>'s
     <a for="fetch params">controller</a>'s <a for="fetch controller">report timing steps</a> given
     <var>fetchParams</var>'s <a for="fetch params">request</a>'s <a for=request>client</a>'s
     <a for="environment settings object">global object</a>.
    </ol>

   <li><p><a>Queue a fetch task</a> to run <var>processResponseEndOfBodyTask</var> with
   <var>fetchParams</var>'s <a for="fetch params">task destination</a>.
  </ol>
 </li>

 <li><p>If <var>fetchParams</var>'s <a for="fetch params">process response</a> is non-null, then
 <a>queue a fetch task</a> to run <var>fetchParams</var>'s
 <a for="fetch params">process response</a> given <var>response</var>, with <var>fetchParams</var>'s
 <a for="fetch params">task destination</a>.

 <li><p>If <var>response</var>'s <a for=response>body</a> is null, then run
 <var>processResponseEndOfBody</var>.

 <li>
  <p>Otherwise:</p>

  <ol>
   <li><p>Let <var>transformStream</var> be a new {{TransformStream}}.

   <li><p>Let <var>identityTransformAlgorithm</var> be an algorithm which, given <var>chunk</var>,
   <a for=TransformStream lt=enqueue>enqueues</a> <var>chunk</var> in <var>transformStream</var>.

   <li><p><a for=TransformStream>Set up</a> <var>transformStream</var> with
   <a for="TransformStream/set up"><i>transformAlgorithm</i></a> set to
   <var>identityTransformAlgorithm</var> and
   <a for="TransformStream/set up"><i>flushAlgorithm</i></a> set to
   <var>processResponseEndOfBody</var>.

   <li><p>Set <var>response</var>'s <a for=response>body</a>'s <a for=body>stream</a> to the result
   of <var>response</var>'s <a for=response>body</a>'s <a for=body>stream</a>
   <a for=ReadableStream>piped through</a> <var>transformStream</var>.
  </ol>

  <p class=note>This {{TransformStream}} is needed for the purpose of receiving a notification when
  the stream reaches its end, and is otherwise an <a>identity transform stream</a>.

 <li>
  <p>If <var>fetchParams</var>'s <a for="fetch params">process response consume body</a> is
  non-null, then:

  <ol>
   <li><p>Let <var>processBody</var> given <var>nullOrBytes</var> be this step: run
   <var>fetchParams</var>'s <a for="fetch params">process response consume body</a> given
   <var>response</var> and <var>nullOrBytes</var>.

   <li><p>Let <var>processBodyError</var> be this step: run <var>fetchParams</var>'s
   <a for="fetch params">process response consume body</a> given <var>response</var> and failure.

   <li><p>If <var>response</var>'s <a for=response>body</a> is null, then <a>queue a fetch task</a>
   to run <var>processBody</var> given null, with <var>fetchParams</var>'s
   <a for="fetch params">task destination</a>.

   <li><p>Otherwise, <a for=body>fully read</a> <var>response</var>'s <a for=response>body</a> given
   <var>processBody</var>, <var>processBodyError</var>, and <var>fetchParams</var>'s
   <a for="fetch params">task destination</a>.
  </ol>
</ol>
</div>


<h3 id=scheme-fetch oldids=basic-fetch>Scheme fetch</h3>

<div algorithm>
<p>To <dfn id=concept-scheme-fetch oldids=concept-basic-fetch>scheme fetch</dfn>, given a
<a for=/>fetch params</a> <var>fetchParams</var>:

<ol>
 <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then return the
 <a for=/>appropriate network error</a> for <var>fetchParams</var>.

 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li>
  <p>Switch on <var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> and run
  the associated steps:

  <dl class=switch>
   <dt>"<code>about</code>"
   <dd>
    <p>If <var>request</var>'s <a for=request>current URL</a>'s <a for=url>path</a> is the string
    "<code>blank</code>", then return a new <a for=/>response</a> whose
    <a for=response>status message</a> is `<code>OK</code>`, <a for=response>header list</a> is «
    (`<code>Content-Type</code>`, `<code>text/html;charset=utf-8</code>`) », and
    <a for=response>body</a> is the empty byte sequence <a for="byte sequence">as a body</a>.

    <p class=note><a for=/>URLs</a> such as "<code>about:config</code>" are handled during
    <a lt=navigate>navigation</a> and result in a <a>network error</a> in the context of
    <a lt=fetch for=/>fetching</a>.

   <dt>"<code>blob</code>"
   <dd>
    <ol>
     <li><p>Let <var>blobURLEntry</var> be <var>request</var>'s <a for=request>current URL</a>'s
     <a for=url>blob URL entry</a>.

     <li>
      <p>If <var>request</var>'s <a for=request>method</a> is not `<code>GET</code>`,
      <var>blobURLEntry</var> is null, or <var>blobURLEntry</var>'s
      <a for="blob URL entry">object</a> is not a {{Blob}} object, then return a
      <a>network error</a>. [[!FILEAPI]]

      <p class=note>The `<code>GET</code>` <a for=/>method</a> restriction serves no useful purpose
      other than being interoperable.

     <li><p>Let <var>blob</var> be <var>blobURLEntry</var>'s <a for="blob URL entry">object</a>.

     <li><p>Let <var>response</var> be a new <a for=/>response</a>.

     <li><p>Let <var>fullLength</var> be <var>blob</var>'s {{Blob/size}}.

     <li><p>Let <var>serializedFullLength</var> be <var>fullLength</var>,
     <a lt="serialize an integer">serialized</a> and <a>isomorphic encoded</a>.

     <li><p>Let <var>type</var> be <var>blob</var>'s {{Blob/type}}.

     <li>
      <p>If <var>request</var>'s <a for=request>header list</a>
      <a for="header list">does not contain</a> `<code>Range</code>`:

      <ol>
       <li><p>Let <var>bodyWithType</var> be the result of <a for=BodyInit>safely extracting</a>
       <var>blob</var>.

       <li><p>Set <var>response</var>'s <a for=response>status message</a> to `<code>OK</code>`.

       <li><p>Set <var>response</var>'s <a for=response>body</a> to <var>bodyWithType</var>'s
       <a for="body with type">body</a>.

       <li><p>Set <var>response</var>'s <a for=response>header list</a> to «
       (`<code>Content-Length</code>`, <var>serializedFullLength</var>),
       (`<code>Content-Type</code>`, <var>type</var>) ».
      </ol>

     <li>
      <p>Otherwise:

      <ol>
       <li><p>Set <var>response</var>'s <a for=response>range-requested flag</a>.

       <li><p>Let <var>rangeHeader</var> be the result of <a for="header list">getting</a>
       `<code>Range</code>` from <var>request</var>'s <a for=request>header list</a>.
       <!-- Range should be added to the headers defined in HTTP extensions. See
            https://github.com/whatwg/fetch/issues/1553 for future work -->

       <li><p>Let <var>rangeValue</var> be the result of <a>parsing a single range header value</a>
       given <var>rangeHeader</var> and true.

       <li><p>If <var>rangeValue</var> is failure, then return a <a>network error</a>.

       <li><p>Let (<var>rangeStart</var>, <var>rangeEnd</var>) be <var>rangeValue</var>.

       <li>
        <p>If <var>rangeStart</var> is null:

        <ol>
         <li><p>Set <var>rangeStart</var> to <var>fullLength</var> &minus; <var>rangeEnd</var>.

         <li><p>Set <var>rangeEnd</var> to <var>rangeStart</var> + <var>rangeEnd</var> &minus; 1.
        </ol>

       <li>
        <p>Otherwise:

        <ol>
         <li><p>If <var>rangeStart</var> is greater than or equal to <var>fullLength</var>, then
         return a <a>network error</a>.

         <li><p>If <var>rangeEnd</var> is null or <var>rangeEnd</var> is greater than or equal to
         <var>fullLength</var>, then set <var>rangeEnd</var> to <var>fullLength</var> &minus; 1.
        </ol>

       <li>
        <p>Let <var>slicedBlob</var> be the result of invoking <a>slice blob</a> given
        <var>blob</var>, <var>rangeStart</var>, <var>rangeEnd</var> + 1, and <var>type</var>.

        <p class=note>A range header denotes an inclusive byte range, while the <a>slice blob</a>
        algorithm input range does not. To use the <a>slice blob</a> algorithm, we have to increment
        <var>rangeEnd</var>.

       <li><p>Let <var>slicedBodyWithType</var> be the result of
       <a for=BodyInit>safely extracting</a> <var>slicedBlob</var>.

       <li><p>Set <var>response</var>'s <a for=response>body</a> to <var>slicedBodyWithType</var>'s
       <a for="body with type">body</a>.

       <li><p>Let <var>serializedSlicedLength</var> be <var>slicedBlob</var>'s {{Blob/size}},
       <a lt="serialize an integer">serialized</a> and <a>isomorphic encoded</a>.

       <!-- The following steps for content-range should be definined in a separate algorithm.
            See https://github.com/whatwg/fetch/issues/1552 for future work -->
       <li><p>Let <var>contentRange</var> be `<code>bytes </code>`.

       <li><p>Append <var>rangeStart</var>, <a lt="serialize an integer">serialized</a> and
       <a>isomorphic encoded</a>, to <var>contentRange</var>.

       <li><p>Append 0x2D (-) to <var>contentRange</var>.

       <li><p>Append <var>rangeEnd</var>, <a lt="serialize an integer">serialized</a> and
       <a>isomorphic encoded</a> to <var>contentRange</var>.

       <li><p>Append 0x2F (/) to <var>contentRange</var>.

       <li><p>Append <var>serializedFullLength</var> to <var>contentRange</var>.

       <li><p>Set <var>response</var>'s <a for=response>status</a> to 206.

       <li><p>Set <var>response</var>'s <a for=response>status message</a> to
       `<code>Partial Content</code>`.

       <li><p>Set <var>response</var>'s <a for=response>header list</a> to «
       (`<code>Content-Length</code>`, <var>serializedSlicedLength</var>),
       (`<code>Content-Type</code>`, <var>type</var>), (`<code>Content-Range</code>`,
       <var>contentRange</var>) ».
      </ol>

     <li><p>Return <var>response</var>.
    </ol>

   <dt>"<code>data</code>"
   <dd>
    <ol>
     <li><p>Let <var>dataURLStruct</var> be the result of running the
     <a><code>data:</code> URL processor</a> on <var>request</var>'s <a for=request>current URL</a>.

     <li><p>If <var>dataURLStruct</var> is failure, then return a <a>network error</a>.

     <li><p>Let <var>mimeType</var> be <var>dataURLStruct</var>'s
     <a for="data: URL struct">MIME type</a>, <a lt="serialize a MIME type to bytes">serialized</a>.

     <li><p>Return a new <a for=/>response</a> whose <a for=response>status message</a> is
     `<code>OK</code>`, <a for=response>header list</a> is « (`<code>Content-Type</code>`,
     <var>mimeType</var>) », and <a for=response>body</a> is <var>dataURLStruct</var>'s
     <a for="data: URL struct">body</a> <a for="byte sequence">as a body</a>.
    </ol>

   <dt>"<code>file</code>"
   <dd>
    <p>For now, unfortunate as it is, <code>file:</code> <a for=/>URLs</a> are left as an exercise
    for the reader.

    <p>When in doubt, return a <a>network error</a>.

   <dt><a>HTTP(S) scheme</a>
   <dd><p>Return the result of running <a>HTTP fetch</a> given <var>fetchParams</var>.
  </dl>

 <li><p>Return a <a for=/>network error</a>.
</ol>
</div>


<h3 id=http-fetch>HTTP fetch</h3>

<div algorithm>
<p>To <dfn export id=concept-http-fetch>HTTP fetch</dfn>, given a <a for=/>fetch params</a>
<var>fetchParams</var> and an optional boolean <var>makeCORSPreflight</var> (default false), run
these steps:
<!-- This is exported for service workers, but that specification only mentions it in passing. -->

<ol>
 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li><p>Let <var>response</var> be null.

 <li><p>Let <var>actualResponse</var> be null.

 <li>
  <p>If <var>request</var>'s <a>service-workers mode</a> is "<code>all</code>", then:

  <ol>
   <li><p>Let <var>requestForServiceWorker</var> be a <a for=request>clone</a> of
   <var>request</var>.

   <li>
    <p>If <var>requestForServiceWorker</var>'s <a for=/>body</a> is non-null, then:

    <ol>
     <li><p>Let <var>transformStream</var> be a new {{TransformStream}}.

     <li>
      <p>Let <var>transformAlgorithm</var> given <var>chunk</var> be these steps:

      <ol>
       <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then abort these
       steps.

       <li><p>If <var>chunk</var> is not a {{Uint8Array}} object, then
       <a for="fetch controller">terminate</a> <var>fetchParams</var>'s
       <a for="fetch params">controller</a>.

       <li><p>Otherwise, <a for=ReadableStream>enqueue</a> <var>chunk</var> in
       <var>transformStream</var>. The user agent may split the chunk into
       <a>implementation-defined</a> practical sizes and <a for=ReadableStream>enqueue</a> each of
       them. The user agent also may concatenate the chunks into an <a>implementation-defined</a>
       practical size and <a for=ReadableStream>enqueue</a> it.
      </ol>

     <li><p><a for=TransformStream>Set up</a> <var>transformStream</var> with
     <a for="TransformStream/set up"><i>transformAlgorithm</i></a> set to
     <var>transformAlgorithm</var>.

     <li><p>Set <var>requestForServiceWorker</var>'s <a for=/>body</a>'s <a for=body>stream</a> to
     the result of <var>requestForServiceWorker</var>'s <a for=/>body</a>'s <a for=body>stream</a>
     <a for=ReadableStream>piped through</a> <var>transformStream</var>.
    </ol>

   <li><p>Let <var>serviceWorkerStartTime</var> be the <a for=/>coarsened shared current time</a>
   given <var>fetchParams</var>'s <a for="fetch params">cross-origin isolated capability</a>.

   <li><p>Set <var>response</var> to the result of invoking <a for=/>handle fetch</a> for
   <var>requestForServiceWorker</var>, with <var>fetchParams</var>'s
   <a for="fetch params">controller</a> and <var>fetchParams</var>'s
   <a for="fetch params">cross-origin isolated capability</a>. [[!HTML]] [[!SW]]

   <li>
    <p>If <var>response</var> is non-null, then:

    <ol>
     <li><p>Set <var>fetchParams</var>'s <a for="fetch params">timing info</a>'s
     <a for="fetch timing info">final service worker start time</a> to
     <var>serviceWorkerStartTime</var>.

     <li>If <var>request</var>'s <a for=request>body</a> is non-null, then
     <a for=ReadableStream>cancel</a> <var>request</var>'s <a for=request>body</a> with undefined.

     <li><p>Set <var>actualResponse</var> to <var>response</var>, if <var>response</var> is not a
     <a>filtered response</a>, and to <var>response</var>'s
     <a for="filtered response">internal response</a> otherwise.

     <li>
      <p>If one of the following is true

      <ul class=brief>
       <li><p><var>response</var>'s <a for=response>type</a> is "<code>error</code>"

       <li><p><var>request</var>'s <a for=request>mode</a> is "<code>same-origin</code>" and
       <var>response</var>'s <a for=response>type</a> is "<code>cors</code>"

       <li><p><var>request</var>'s <a for=request>mode</a> is not "<code>no-cors</code>" and
       <var>response</var>'s <a for=response>type</a> is "<code>opaque</code>"

       <li><var>request</var>'s <a for=request>redirect mode</a> is not "<code>manual</code>" and
       <var>response</var>'s <a for=response>type</a> is "<code>opaqueredirect</code>"

       <li><var>request</var>'s <a for=request>redirect mode</a> is not "<code>follow</code>" and
       <var>response</var>'s <a for=response>URL list</a> has more than one item.
      </ul>

      <p>then return a <a>network error</a>.
    </ol>
  </ol>

 <li>
  <p>If <var>response</var> is null, then:

  <ol>
   <li>
    <p>If <var>makeCORSPreflight</var> is true and one of these conditions is true:

    <ul class=brief>
     <li><p>There is no <a>method cache entry match</a> for <var>request</var>'s
     <a for=request>method</a> using <var>request</var>, and either <var>request</var>'s
     <a for=request>method</a> is not a <a>CORS-safelisted method</a> or <var>request</var>'s
     <a>use-CORS-preflight flag</a> is set.

     <li>There is at least one <a for=list>item</a> in the <a>CORS-unsafe request-header names</a>
     with <var>request</var>'s <a for=request>header list</a> for which there is no
     <a>header-name cache entry match</a> using <var>request</var>.
    </ul>

    <p>Then:

    <ol>
     <li><p>Let <var>preflightResponse</var> be the result of running <a>CORS-preflight fetch</a>
     given <var>request</var>.

     <li><p>If <var>preflightResponse</var> is a <a>network error</a>, then return
     <var>preflightResponse</var>.
    </ol>

    <p class=note>This step checks the <a>CORS-preflight cache</a> and if there is no suitable entry
    it performs a <a>CORS-preflight fetch</a> which, if successful, populates the cache. The purpose
    of the <a>CORS-preflight fetch</a> is to ensure the <a lt=fetch for=/>fetched</a> resource is
    familiar with the <a>CORS protocol</a>. The cache is there to minimize the number of
    <a lt="CORS-preflight fetch">CORS-preflight fetches</a>.

   <li>
    <p>If <var>request</var>'s <a for=request>redirect mode</a> is "<code>follow</code>", then set
    <var>request</var>'s <a>service-workers mode</a> to "<code>none</code>".

    <p class=note>Redirects coming from the network (as opposed to from a service worker) are not to
    be exposed to a service worker.

   <li><p>Set <var>response</var> and <var>actualResponse</var> to the result of running
   <a>HTTP-network-or-cache fetch</a> given <var>fetchParams</var>.

   <li>
    <p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>cors</code>" and a
    <a>CORS check</a> for <var>request</var> and <var>response</var> returns failure, then return a
    <a>network error</a>.

    <p class=note>As the <a>CORS check</a> is not to be applied to <a for=/>responses</a> whose
    <a for=response>status</a> is 304 or 407, or <a for=/>responses</a> from a service worker for
    that matter, it is applied here.

   <li><p>If the <a>TAO check</a> for <var>request</var> and <var>response</var> returns failure,
   then set <var>request</var>'s <a for=request>timing allow failed flag</a>.
  </ol>

 <li>
  <p>If either <var>request</var>'s <a for=request>response tainting</a> or <var>response</var>'s
  <a for=response>type</a> is "<code>opaque</code>", and the
  <a>cross-origin resource policy check</a> with <var>request</var>'s <a for=request>origin</a>,
  <var>request</var>'s <a for=request>client</a>, <var>request</var>'s
  <a for=request>destination</a>, and <var>actualResponse</var> returns <b>blocked</b>, then return
  a <a>network error</a>.

  <p class=note>The <a>cross-origin resource policy check</a> runs for responses coming from the
  network and responses coming from the service worker. This is different from the
  <a>CORS check</a>, as <var>request</var>'s <a for=request>client</a> and the service worker can
  have different embedder policies.

 <li>
  <p>If <var>actualResponse</var>'s <a for=response>status</a> is a <a>redirect status</a>, then:

  <ol>
   <li>
    <p>If <var>actualResponse</var>'s <a for=response>status</a> is not 303, <var>request</var>'s
    <a for=request>body</a> is non-null, and the <a>connection</a> uses HTTP/2, then user agents
    may, and are even encouraged to, transmit an <code>RST_STREAM</code> frame.

    <p class=note>303 is excluded as certain communities ascribe special status to it.

   <li>
    <p>Switch on <var>request</var>'s
    <a for=request>redirect mode</a>:

    <dl class=switch>
     <dt>"<code>error</code>"
     <dd>
      <ol><li><p>Set <var>response</var> to a <a>network error</a>.</ol>

     <dt>"<code>manual</code>"
     <dd>
      <ol>
       <li><p>If <var>request</var>'s <a for=request>mode</a> is "<code>navigate</code>", then set
       <var>fetchParams</var>'s <a for="fetch params">controller</a>'s
       <a for="fetch controller">next manual redirect steps</a> to run <a>HTTP-redirect fetch</a>
       given <var>fetchParams</var> and <var>response</var>.

       <li><p>Otherwise, set <var>response</var> to an <a>opaque-redirect filtered response</a>
       whose <a for="filtered response">internal response</a> is <var>actualResponse</var>.
      </ol>

     <dt>"<code>follow</code>"
     <dd>
      <ol><li><p>Set <var>response</var> to the result of running <a>HTTP-redirect fetch</a> given
      <var>fetchParams</var> and <var>response</var>.</ol>
    </dl>
    <!-- not resetting actualResponse since it's no longer used anyway -->
  </ol>

 <li><p>Return <var>response</var>. <span class=note>Typically <var>actualResponse</var>'s
 <a for=response>body</a>'s <a for=body>stream</a> is still being enqueued to after
 returning.</span>
</ol>
</div>


<h3 id=http-redirect-fetch>HTTP-redirect fetch</h3>

<div algorithm>
<p>To <dfn export id=concept-http-redirect-fetch>HTTP-redirect fetch</dfn>, given a
<a for=/>fetch params</a> <var>fetchParams</var> and a <a for=/>response</a> <var>response</var>,
run these steps:

<ol>
 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li><p>Let <var>actualResponse</var> be <var>response</var>, if <var>response</var> is not a
 <a>filtered response</a>, and <var>response</var>'s
 <a for="filtered response">internal response</a> otherwise.

 <li><p>Let <var>locationURL</var> be <var>actualResponse</var>'s <a for=response>location URL</a>
 given <var>request</var>'s <a for=request>current URL</a>'s <a for=url>fragment</a>.

 <li><p>If <var>locationURL</var> is null, then return <var>response</var>.

 <li><p>If <var>locationURL</var> is failure, then return a <a>network error</a>.

 <li><p>If <var>locationURL</var>'s <a for=url>scheme</a> is not an <a>HTTP(S) scheme</a>, then
 return a <a>network error</a>.

 <li><p>If <var>request</var>'s <a for=request>redirect count</a> is 20, then return a
 <a>network error</a>.

 <li><p>Increase <var>request</var>'s <a for=request>redirect count</a> by 1.

 <li><p>If <var>request</var>'s <a for=request>mode</a> is "<code>cors</code>",
 <var>locationURL</var> <a>includes credentials</a>, and <var>request</var>'s
 <a for=request>origin</a> is not <a>same origin</a> with <var>locationURL</var>'s
 <a for=url>origin</a>, then return a <a>network error</a>.

 <li>
  <p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>cors</code>" and
  <var>locationURL</var> <a>includes credentials</a>, then return a <a>network error</a>.

  <p class=note>This catches a cross-origin resource redirecting to a same-origin URL.

 <li><p>If <var>actualResponse</var>'s <a for=response>status</a> is not 303, <var>request</var>'s
 <a for=request>body</a> is non-null, and <var>request</var>'s <a for=request>body</a>'s
 <a for=body>source</a> is null, then return a <a>network error</a>.

 <li>
  <p>If one of the following is true

  <ul class=brief>
   <li><p><var>actualResponse</var>'s <a for=response>status</a> is 301 or 302 and
   <var>request</var>'s <a for=request>method</a> is `<code>POST</code>`
   <li><p><var>actualResponse</var>'s <a for=response>status</a> is 303 and <var>request</var>'s
   <a for=request>method</a> is not `<code>GET</code>` or `<code>HEAD</code>`
  </ul>

  <p>then:

  <ol>
   <li><p>Set <var>request</var>'s <a for=request>method</a> to `<code>GET</code>` and
   <var>request</var>'s <a for=request>body</a> to null.

   <li><p><a for="list">For each</a> <var>headerName</var> of <a>request-body-header name</a>,
   <a for="header list">delete</a> <var>headerName</var> from <var>request</var>'s
   <a for=request>header list</a>.
  </ol>

 <li>
  <p>If <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> is not
  <a>same origin</a> with <var>locationURL</var>'s <a for=url>origin</a>, then
  <a for=list>for each</a> <var>headerName</var> of <a>CORS non-wildcard request-header name</a>,
  <a for="header list">delete</a> <var>headerName</var> from <var>request</var>'s
  <a for=request>header list</a>.

  <p class=note>I.e., the moment another origin is seen after the initial request, the
  `<code>Authorization</code>` header is removed.

 <li>
  <p>If <var>request</var>'s <a for=request>body</a> is non-null, then set <var>request</var>'s
  <a for=request>body</a> to the <a for="body with type">body</a> of the result of
  <a for=BodyInit>safely extracting</a> <var>request</var>'s <a for=request>body</a>'s
  <a for=body>source</a>.

  <p class=note><var>request</var>'s <a for=request>body</a>'s <a for=body>source</a>'s nullity has
  already been checked.

 <li><p>Let <var>timingInfo</var> be <var>fetchParams</var>'s <a for="fetch params">timing info</a>.

 <li><p>Set <var>timingInfo</var>'s <a for="fetch timing info">redirect end time</a> and
 <a for="fetch timing info">post-redirect start time</a> to the
 <a for=/>coarsened shared current time</a> given <var>fetchParams</var>'s
 <a for="fetch params">cross-origin isolated capability</a>.

 <li><p>If <var>timingInfo</var>'s <a for="fetch timing info">redirect start time</a> is 0, then set
 <var>timingInfo</var>'s <a for="fetch timing info">redirect start time</a> to
 <var>timingInfo</var>'s <a for="fetch timing info">start time</a>.

 <li><p><a for=list>Append</a> <var>locationURL</var> to <var>request</var>'s
 <a for=request>URL list</a>.

 <li><p>Invoke <a>set <var>request</var>'s referrer policy on redirect</a> on <var>request</var> and
 <var>actualResponse</var>. [[!REFERRER]]

 <li>
  <p>Return the result of running <a>main fetch</a> given <var>fetchParams</var> and true.

  <p class=note>This has to invoke <a>main fetch</a> to get <var>request</var>'s
  <a for=request>response tainting</a> correct.
</ol>
</div>


<h3 id=http-network-or-cache-fetch>HTTP-network-or-cache fetch</h3>

<div algorithm>
<p>To <dfn id=concept-http-network-or-cache-fetch>HTTP-network-or-cache fetch</dfn>, given a
<a for=/>fetch params</a> <var>fetchParams</var>, an optional boolean
<var>isAuthenticationFetch</var> (default false), and an optional boolean
<var>isNewConnectionFetch</var> (default false), run these steps:

<p class=note>Some implementations might support caching of partial content, as per
<cite>HTTP Caching</cite>. However, this is not widely supported by browser caches.
[[HTTP-CACHING]]

<ol>
 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li><p>Let <var>httpFetchParams</var> be null.

 <li><p>Let <var>httpRequest</var> be null.

 <li><p>Let <var>response</var> be null.

 <li><p>Let <var>storedResponse</var> be null.

 <li><p>Let <var>httpCache</var> be null.

 <li><p>Let the <var>revalidatingFlag</var> be unset.

 <li>
  <p>Run these steps, but <a>abort when</a> <var>fetchParams</var> is
  <a for="fetch params">canceled</a>:

  <ol>
   <li><p>If <var>request</var>'s <a for=request>window</a> is "<code>no-window</code>" and
   <var>request</var>'s <a for=request>redirect mode</a> is "<code>error</code>", then set
   <var>httpFetchParams</var> to <var>fetchParams</var> and <var>httpRequest</var> to
   <var>request</var>.

   <li>
    <p>Otherwise:

    <ol>
     <li>
      <p>Set <var>httpRequest</var> to a <a for=request>clone</a> of <var>request</var>.

      <p class=note>Implementations are encouraged to avoid teeing <var>request</var>'s
      <a for=request>body</a>'s <a for=body>stream</a> when <var>request</var>'s
      <a for=request>body</a>'s <a for=body>source</a> is null as only a single body is needed in
      that case. E.g., when <var>request</var>'s <a for=request>body</a>'s <a for=body>source</a>
      is null, redirects and authentication will end up failing the fetch.

     <li><p>Set <var>httpFetchParams</var> to a copy of <var>fetchParams</var>.

     <li><p>Set <var>httpFetchParams</var>'s <a for="fetch params">request</a> to
     <var>httpRequest</var>.
    </ol>

   <li>
    <p>Let <var>includeCredentials</var> be true if one of

    <ul class=brief>
     <li><var>request</var>'s <a for=request>credentials mode</a> is
     "<code>include</code>"
     <li><var>request</var>'s  <a for=request>credentials mode</a> is
     "<code>same-origin</code>" and <var>request</var>'s
     <a for=request>response tainting</a> is "<code>basic</code>"
    </ul>

    <p>is true; otherwise false.

   <li><p>If <a>Cross-Origin-Embedder-Policy allows credentials</a> with <var>request</var> returns
   false, then set <var>includeCredentials</var> to false.

   <li><p>Let <var>contentLength</var> be <var>httpRequest</var>'s <a for=request>body</a>'s
   <a for=body>length</a>, if <var>httpRequest</var>'s <a for=request>body</a> is non-null;
   otherwise null.

   <li><p>Let <var>contentLengthHeaderValue</var> be null.

   <li><p>If <var>httpRequest</var>'s <a for=request>body</a> is null and <var>httpRequest</var>'s
   <a for=request>method</a> is `<code>POST</code>` or `<code>PUT</code>`, then set
   <var>contentLengthHeaderValue</var> to `<code>0</code>`.
   <!-- https://chromium.googlesource.com/chromium/src/+/master/net/http/http_network_transaction.cc#982 -->

   <li><p>If <var>contentLength</var> is non-null, then set  <var>contentLengthHeaderValue</var> to
   <var>contentLength</var>, <a lt="serialize an integer">serialized</a> and
   <a>isomorphic encoded</a>.

   <li><p>If <var>contentLengthHeaderValue</var> is non-null, then <a for="header list">append</a>
   (`<code>Content-Length</code>`, <var>contentLengthHeaderValue</var>) to <var>httpRequest</var>'s
   <a for=request>header list</a>.

   <li>
    <p>If <var>contentLength</var> is non-null and <var>httpRequest</var>'s
    <a for=request>keepalive</a> is true, then:

    <ol>
     <li><p>Let <var>inflightKeepaliveBytes</var> be 0.

     <li><p>Let <var>group</var> be <var>httpRequest</var>'s <a for=request>client</a>'s
     <a>fetch group</a>.

     <li><p>Let <var>inflightRecords</var> be the set of <a for="fetch group">fetch records</a> in
     <var>group</var> whose <a for="fetch record">request</a>'s <a for=request>keepalive</a> is true
     and <a>done flag</a> is unset.

     <li>
      <p><a for=set>For each</a> <var>fetchRecord</var> of <var>inflightRecords</var>:

      <ol>
       <li><p>Let <var>inflightRequest</var> be <var>fetchRecord</var>'s
       <a for="fetch record">request</a>.

       <li><p>Increment <var>inflightKeepaliveBytes</var> by <var>inflightRequest</var>'s
       <a for=request>body</a>'s <a for=body>length</a>.
      </ol>

     <li><p>If the sum of <var>contentLength</var> and <var>inflightKeepaliveBytes</var> is greater
     than 64 kibibytes, then return a <a>network error</a>.
    </ol>

    <p class=note>The above limit ensures that requests that are allowed to outlive the
    <a>environment settings object</a> and contain a body, have a bounded size and are not allowed
    to stay alive indefinitely.

   <li>
    <p>If <var>httpRequest</var>'s <a for=request>referrer</a> is a <a for=/>URL</a>, then:

    <ol>
     <li><p>Let <var>referrerValue</var> be <var>httpRequest</var>'s <a for=request>referrer</a>,
     <a lt="URL serializer">serialized</a> and <a>isomorphic encoded</a>.

     <li><p><a for="header list">Append</a> (`<code>Referer</code>`, <var>referrerValue</var>) to
     <var>httpRequest</var>'s <a for=request>header list</a>.
    </ol>

   <li><p><a>Append a request `<code>Origin</code>` header</a> for <var>httpRequest</var>.

   <li><p><a abstract-op lt="append the Fetch metadata headers for a request">Append the Fetch metadata headers for <var>httpRequest</var></a>.
   [[!FETCH-METADATA]]

   <li><p>If <var>httpRequest</var>'s <a for=request>initiator</a> is "<code>prefetch</code>", then
   <a>set a structured field value</a> given (`<a http-header><code>Sec-Purpose</code></a>`,
   the <a data-lt="structured field token">token</a> <code>prefetch</code>) in
   <var>httpRequest</var>'s <a for=request>header list</a>.

   <li><p>If <var>httpRequest</var>'s <a for=request>header list</a>
   <a for="header list">does not contain</a> `<code>User-Agent</code>`, then user agents should
   <a for="header list">append</a> (`<code>User-Agent</code>`,
   <a>default `<code>User-Agent</code>` value</a>) to <var>httpRequest</var>'s
   <a for=request>header list</a>.

   <li><p>If <var>httpRequest</var>'s <a for=request>cache mode</a> is "<code>default</code>" and
   <var>httpRequest</var>'s <a for=request>header list</a> <a for="header list">contains</a>
   `<code>If-Modified-Since</code>`,
   `<code>If-None-Match</code>`,
   `<code>If-Unmodified-Since</code>`,
   `<code>If-Match</code>`, or
   `<code>If-Range</code>`, then set <var>httpRequest</var>'s
   <a for=request>cache mode</a> to "<code>no-store</code>".

   <li><p>If <var>httpRequest</var>'s <a for=request>cache mode</a> is "<code>no-cache</code>",
   <var>httpRequest</var>'s <a for=request>prevent no-cache cache-control header modification flag</a>
   is unset, and <var>httpRequest</var>'s <a for=request>header list</a>
   <a for="header list">does not contain</a> `<code>Cache-Control</code>`, then
   <a for="header list">append</a> (`<code>Cache-Control</code>`, `<code>max-age=0</code>`) to
   <var>httpRequest</var>'s <a for=request>header list</a>.

   <li>
    <p>If <var>httpRequest</var>'s <a for=request>cache mode</a> is "<code>no-store</code>" or
    "<code>reload</code>", then:

    <ol>
     <li><p>If <var>httpRequest</var>'s <a for=request>header list</a>
     <a for="header list">does not contain</a> `<code>Pragma</code>`, then
     <a for="header list">append</a> (`<code>Pragma</code>`, `<code>no-cache</code>`) to
     <var>httpRequest</var>'s <a for=request>header list</a>.

     <li><p>If <var>httpRequest</var>'s <a for=request>header list</a>
     <a for="header list">does not contain</a> `<code>Cache-Control</code>`, then
     <a for="header list">append</a> (`<code>Cache-Control</code>`, `<code>no-cache</code>`) to
     <var>httpRequest</var>'s <a for=request>header list</a>.
     <!-- Technically this only applies to HTTP/1.1 and up -->
    </ol>

   <li>
    <p>If <var>httpRequest</var>'s <a for=request>header list</a> <a for="header list">contains</a>
    `<code>Range</code>`, then <a for="header list">append</a> (`<code>Accept-Encoding</code>`,
    `<code>identity</code>`) to <var>httpRequest</var>'s <a for=request>header list</a>.

    <div class=note>
     <p>This avoids a failure when <a lt="handle content codings">handling content codings</a> with
     a part of an encoded <a for=/>response</a>.

     <p>Additionally,
     <a href="https://jakearchibald.github.io/accept-encoding-range-test/">many servers</a>
     mistakenly ignore `<code>Range</code>` headers if a non-identity encoding is accepted.
    </div>

   <li>
    <p>Modify <var>httpRequest</var>'s <a for=request>header list</a> per HTTP. Do not
    <a for="header list">append</a> a given <a>header</a> if <var>httpRequest</var>'s
    <a for=request>header list</a> <a for="header list">contains</a> that <a>header</a>'s
    <a for=header>name</a>.

    <p class=note>It would be great if we could make this more normative somehow. At this point
    <a for=/>headers</a> such as
    `<code>Accept-Encoding</code>`,
    `<code>Connection</code>`,
    `<code>DNT</code>`, and
    `<code>Host</code>`,
    are to be <a for="header list">appended</a> if necessary.

    <p>`<code>Accept</code>`,
    `<code>Accept-Charset</code>`, and
    `<code>Accept-Language</code>` must not be included at this point.

    <p class=note>`<code>Accept</code>` and `<code>Accept-Language</code>` are already included
    (unless <a method><code>fetch()</code></a> is used, which does not include the latter by
    default), and `<code>Accept-Charset</code>` is a waste of bytes. See
    <a>HTTP header layer division</a> for more details.

   <li>
    <p>If <var>includeCredentials</var> is true, then:

    <ol>
     <li>
      <p>If the user agent is not configured to block cookies for <var>httpRequest</var> (see
      <a href=https://httpwg.org/specs/rfc6265.html#privacy-considerations>section 7</a> of
      [[!COOKIES]]), then:

      <ol>
       <li><p>Let <var>cookies</var> be the result of running the "cookie-string" algorithm (see
       <a href=https://httpwg.org/specs/rfc6265.html#cookie>section 5.4</a> of
       [[!COOKIES]]) with the user agent's cookie store and <var>httpRequest</var>'s
       <a for=request>current URL</a>.

       <li>If <var>cookies</var> is not the empty string, then <a for="header list">append</a>
       (`<code>Cookie</code>`, <var>cookies</var>) to <var>httpRequest</var>'s
       <a for=request>header list</a>.
      </ol>

     <li>
      <p>If <var>httpRequest</var>'s <a for=request>header list</a>
      <a for="header list">does not contain</a> `<code>Authorization</code>`, then:

      <!-- https://wiki.whatwg.org/wiki/HTTP_Authentication -->
      <ol>
       <li><p>Let <var>authorizationValue</var> be null.

       <li><p>If there's an <a>authentication entry</a> for <var>httpRequest</var> and either
       <var>httpRequest</var>'s <a for=request>use-URL-credentials flag</a> is unset or
       <var>httpRequest</var>'s <a for=request>current URL</a> does not <a>include credentials</a>,
       then set <var>authorizationValue</var> to <a>authentication entry</a>.
       <!-- need to define the cache concept -->

       <li><p>Otherwise, if <var>httpRequest</var>'s <a for=request>current URL</a> does
       <a>include credentials</a> and <var>isAuthenticationFetch</var> is true, set
       <var>authorizationValue</var> to <var>httpRequest</var>'s <a for=request>current URL</a>,
       <span class=XXX>converted to an `<code>Authorization</code>` value</span>.

       <li><p>If <var>authorizationValue</var> is non-null, then <a for="header list">append</a>
       (`<code>Authorization</code>`, <var>authorizationValue</var>) to <var>httpRequest</var>'s
       <a for=request>header list</a>.
      </ol>
    </ol>

   <li>
    <p>If there's a <a>proxy-authentication entry</a>, use it as appropriate.

    <p class=note>This intentionally does not depend on <var>httpRequest</var>'s
    <a for=request>credentials mode</a>.

   <li><p>Set <var>httpCache</var> to the result of <a>determining the HTTP cache partition</a>,
   given <var>httpRequest</var>.

   <li><p>If <var>httpCache</var> is null, then set <var>httpRequest</var>'s
   <a for=request>cache mode</a> to "<code>no-store</code>".

   <li>
    <p>If <var>httpRequest</var>'s <a for=request>cache mode</a> is neither "<code>no-store</code>"
    nor "<code>reload</code>", then:

    <ol>
     <li>
      <p>Set <var>storedResponse</var> to the result of selecting a response from the
      <var>httpCache</var>, possibly needing validation, as per the
      "<a>Constructing Responses from Caches</a>" chapter of <cite>HTTP Caching</cite>, if any.
      [[!HTTP-CACHING]]

      <p class=note>As mandated by HTTP, this still takes the `<code>Vary</code>`
      <a for=/>header</a> into account.

     <li>
      <p>If <var>storedResponse</var> is non-null, then:

      <!-- cache hit -->
      <ol>
       <li>
        <p>If <a for=request>cache mode</a> is "<code>default</code>", <var>storedResponse</var>
        is a <a>stale-while-revalidate response</a>, and <var>httpRequest</var>'s
        <a for=request>client</a> is non-null, then:

        <ol>
         <li><p>Set <var>response</var> to <var>storedResponse</var>.

         <li><p>Set <var>response</var>'s <a for=response>cache state</a> to "<code>local</code>".

         <li><p>Let <var>revalidateRequest</var> be a <a for=request>clone</a> of
         <var>request</var>.

         <li><p>Set <var>revalidateRequest</var>'s <a for=request>cache mode</a> set to
         "<code>no-cache</code>".

         <li><p>Set <var>revalidateRequest</var>'s
         <a for=request>prevent no-cache cache-control header modification flag</a>.

         <li><p>Set <var>revalidateRequest</var>'s <a for=request>service-workers mode</a> set to
         "<code>none</code>".

         <li>
          <p><a>In parallel</a>, run <a>main fetch</a> given a new <a for=/>fetch params</a> whose
          <a for="fetch params">request</a> is <var>revalidateRequest</var>.

          <p class=note>This fetch is only meant to update the state of <var>httpCache</var>
          and the response will be unused until another cache access. The stale response will be used
          as the response to current request. This fetch is issued in the context of a client so if
          it goes away the request will be terminated.
        </ol>

       <li>
        <p>Otherwise:

        <ol>
         <li><p>If <var>storedResponse</var> is a <a>stale response</a>, then set the
         <var>revalidatingFlag</var>.

         <li>
          <p>If the <var>revalidatingFlag</var> is set and <var>httpRequest</var>'s
          <a for=request>cache mode</a> is neither "<code>force-cache</code>" nor
          "<code>only-if-cached</code>", then:

          <ol>
           <li><p>If <var>storedResponse</var>'s <a for=response>header list</a>
           <a for="header list">contains</a> `<code>ETag</code>`, then
           <a for="header list">append</a> (`<code>If-None-Match</code>`, `<code>ETag</code>`'s
           <a for=header>value</a>) to <var>httpRequest</var>'s <a for=request>header list</a>.

           <li><p>If <var>storedResponse</var>'s <a for=response>header list</a>
           <a for="header list">contains</a> `<code>Last-Modified</code>`, then
           <a for="header list">append</a> (`<code>If-Modified-Since</code>`,
           `<code>Last-Modified</code>`'s <a for=header>value</a>) to <var>httpRequest</var>'s
           <a for=request>header list</a>.
          </ol>

          <p class=note>See also the "<a>Sending a Validation Request</a>" chapter of
          <cite>HTTP Caching</cite>. [[!HTTP-CACHING]]

         <li><p>Otherwise, set <var>response</var> to <var>storedResponse</var> and set
         <var>response</var>'s <a for=response>cache state</a> to "<code>local</code>".
        </ol>
      </ol>
    </ol>
  </ol>

 <li><p><a>If aborted</a>, then return the <a for=/>appropriate network error</a> for
 <var>fetchParams</var>.


 <!-- If response is still null, we require a forwarded request. -->
 <li>
  <p>If <var>response</var> is null, then:

  <ol>
   <li><p>If <var>httpRequest</var>'s <a for=request>cache mode</a> is
   "<code>only-if-cached</code>", then return a <a>network error</a>.

   <li><p>Let <var>forwardResponse</var> be the result of running <a>HTTP-network fetch</a> given
   <var>httpFetchParams</var>, <var>includeCredentials</var>, and <var>isNewConnectionFetch</var>.

   <li><p>If <var>httpRequest</var>'s <a for=request>method</a> is <a>unsafe</a> and
   <var>forwardResponse</var>'s <a for=response>status</a> is in the range 200 to 399, inclusive,
   invalidate appropriate stored responses in <var>httpCache</var>, as per the
   "<a>Invalidating Stored Responses</a>" chapter of <cite>HTTP Caching</cite>, and set
   <var>storedResponse</var> to null. [[!HTTP-CACHING]]

   <li>
    <p>If the <var>revalidatingFlag</var> is set and <var>forwardResponse</var>'s
    <a for=response>status</a> is 304, then:

    <ol>
     <li>
      <p>Update <var>storedResponse</var>'s <a for=response>header list</a> using
      <var>forwardResponse</var>'s <a for=response>header list</a>, as per the
      "<a>Freshening Stored Responses upon Validation</a>" chapter of <cite>HTTP Caching</cite>.
      [[!HTTP-CACHING]]

      <p class="note">This updates the stored response in cache as well.

     <li><p>Set <var>response</var> to <var>storedResponse</var>.

     <li><p>Set <var>response</var>'s <a for=response>cache state</a> to "<code>validated</code>".
    </ol>

   <li>
    <p>If <var>response</var> is null, then:

    <ol>
     <li><p>Set <var>response</var> to <var>forwardResponse</var>.

     <li>
      <p>Store <var>httpRequest</var> and <var>forwardResponse</var> in <var>httpCache</var>, as per
      the "<a>Storing Responses in Caches</a>" chapter of <cite>HTTP Caching</cite>.
      [[!HTTP-CACHING]]

      <p class=note>If <var>forwardResponse</var> is a <a>network error</a>, this effectively caches
      the network error, which is sometimes known as "negative caching".

      <p class=note>The associated <a for=response>body info</a> is stored in the cache
      alongside the response.
    </ol>
  </ol>

 <li><p>Set <var>response</var>'s <a for=response>URL list</a> to a <a for=list>clone</a> of
 <var>httpRequest</var>'s <a for=request>URL list</a>.

 <li><p>If <var>httpRequest</var>'s <a for=request>header list</a> <a for="header list">contains</a>
 `<code>Range</code>`, then set <var>response</var>'s <a for=response>range-requested flag</a>.

 <li><p>Set <var>response</var>'s <a for=response>request-includes-credentials</a> to
 <var>includeCredentials</var>.

 <li>
  <p>If <var>response</var>'s <a for=response>status</a> is 401, <var>httpRequest</var>'s
  <a for=request>response tainting</a> is not "<code>cors</code>", <var>includeCredentials</var> is
  true, and <var>request</var>'s <a for=request>window</a> is an <a>environment settings object</a>,
  then:

  <ol>
   <li class=XXX><p>Needs testing: multiple `<code>WWW-Authenticate</code>` headers, missing,
   parsing issues.

   <li>
    <p>If <var>request</var>'s <a for=request>body</a> is non-null, then:

    <ol>
     <li><p>If <var>request</var>'s <a for=request>body</a>'s <a for=body>source</a> is null,
     then return a <a>network error</a>.

     <li><p>Set <var>request</var>'s <a for=request>body</a> to the <a for="body with type">body</a>
     of the result of <a for=BodyInit>safely extracting</a> <var>request</var>'s
     <a for=request>body</a>'s <a for=body>source</a>.
    </ol>

   <li>
    <p>If <var>request</var>'s <a for=request>use-URL-credentials flag</a> is unset or
    <var>isAuthenticationFetch</var> is true, then:

    <ol>
     <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then return the
     <a for=/>appropriate network error</a> for <var>fetchParams</var>.

     <li><p>Let <var>username</var> and <var>password</var> be the result of prompting the end user
     for a username and password, respectively, in <var>request</var>'s
     <a for=request>window</a>.

     <li><p><a>Set the username</a> given <var>request</var>'s <a for=request>current URL</a> and
     <var>username</var>.

     <li><p><a>Set the password</a> given <var>request</var>'s <a for=request>current URL</a> and
     <var>password</var>.
    </ol>

   <li><p>Set <var>response</var> to the result of running <a>HTTP-network-or-cache fetch</a> given
   <var>fetchParams</var> and true.
  </ol>

 <li>
  <p>If <var>response</var>'s <a for=response>status</a> is 407, then:

  <ol>
   <li><p>If <var>request</var>'s <a for=request>window</a> is
   "<code>no-window</code>", then return a <a>network error</a>.

   <li class=XXX><p>Needs testing: multiple `<code>Proxy-Authenticate</code>` headers, missing,
   parsing issues.

   <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then return the
   <a for=/>appropriate network error</a> for <var>fetchParams</var>.

   <li>
    <p>Prompt the end user as appropriate in <var>request</var>'s
    <a for=request>window</a> and store the result as a
    <a>proxy-authentication entry</a>. [[!HTTP]]

    <p class=note>Remaining details surrounding proxy authentication are defined by HTTP.

   <li><p>Set <var>response</var> to the result of running <a>HTTP-network-or-cache fetch</a> given
   <var>fetchParams</var>.
  </ol>

 <li>
  <p>If all of the following are true

  <ul class=brief>
   <li><p><var>response</var>'s <a for=response>status</a> is 421

   <li><p><var>isNewConnectionFetch</var> is false

   <li><p><var>request</var>'s <a for=request>body</a> is null, or <var>request</var>'s
   <a for=request>body</a> is non-null and <var>request</var>'s <a for=request>body</a>'s
   <a for=body>source</a> is non-null
  </ul>

  <p>then:

  <ol>
   <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then return the
   <a for=/>appropriate network error</a> for <var>fetchParams</var>.

   <li><p>Set <var>response</var> to the result of running <a>HTTP-network-or-cache fetch</a> given
   <var>fetchParams</var>, <var>isAuthenticationFetch</var>, and true.
  </ol>

 <li><p>If <var>isAuthenticationFetch</var> is true, then create an <a>authentication entry</a> for
 <var>request</var> and the given realm.

 <li><p>Return <var>response</var>. <span class=note>Typically <var>response</var>'s
 <a for=response>body</a>'s <a for=body>stream</a> is still being enqueued to after
 returning.</span>
</ol>
</div>


<h3 id=http-network-fetch>HTTP-network fetch</h3>

<div algorithm>
<p>To <dfn id=concept-http-network-fetch>HTTP-network fetch</dfn>, given a <a for=/>fetch params</a>
<var>fetchParams</var>, an optional boolean <var>includeCredentials</var> (default false), and an
optional boolean <var>forceNewConnection</var> (default false), run these steps:

<ol>
 <li><p>Let <var>request</var> be <var>fetchParams</var>'s <a for="fetch params">request</a>.

 <li><p>Let <var>response</var> be null.

 <li><p>Let <var>timingInfo</var> be <var>fetchParams</var>'s <a for="fetch params">timing info</a>.

 <li><p>Let <var>networkPartitionKey</var> be the result of
 <a for=request>determining the network partition key</a> given <var>request</var>.

 <li><p>Let <var>newConnection</var> be "<code>yes</code>" if <var>forceNewConnection</var> is true;
 otherwise "<code>no</code>".

 <li>
  <p>Switch on <var>request</var>'s <a for=request>mode</a>:

  <dl>
   <dt>"<code>websocket</code>"
   <dd><p>Let <var>connection</var> be the result of
   <a lt="obtain a WebSocket connection">obtaining a WebSocket connection</a>, given
   <var>request</var>'s <a for=request>current URL</a>.

   <dt>Otherwise
   <dd><p>Let <var>connection</var> be the result of
   <a lt="obtain a connection">obtaining a connection</a>, given <var>networkPartitionKey</var>,
   <var>request</var>'s <a for=request>current URL</a>, <var>includeCredentials</var>, and
   <var>newConnection</var>.
  </dl>

 <li>
  <p>Run these steps, but <a>abort when</a> <var>fetchParams</var> is
  <a for="fetch params">canceled</a>:

  <ol>
   <li><p>If <var>connection</var> is failure, then return a <a>network error</a>.

   <li><p>Set <var>timingInfo</var>'s <a for="fetch timing info">final connection timing info</a> to
   the result of calling <a>clamp and coarsen connection timing info</a> with
   <var>connection</var>'s <a for=connection>timing info</a>, <var>timingInfo</var>'s
   <a for="fetch timing info">post-redirect start time</a>, and <var>fetchParams</var>'s
   <a for="fetch params">cross-origin isolated capability</a>.

   <li><p>If <var>connection</var> is an HTTP/1.x connection, <var>request</var>'s
   <a for=request>body</a> is non-null, and <var>request</var>'s <a for=request>body</a>'s
   <a for=body>source</a> is null, then return a <a>network error</a>.

   <li>Set <var>timingInfo</var>'s <a for="fetch timing info">final network-request start time</a>
   to the <a for=/>coarsened shared current time</a> given <var>fetchParams</var>'s
   <a for="fetch params">cross-origin isolated capability</a>.

   <li>
    <p>Set <var>response</var> to the result of making an HTTP request over <var>connection</var>
    using <var>request</var> with the following caveats:

    <ul>
     <li><p>Follow the relevant requirements from HTTP. [[!HTTP]] [[!HTTP-CACHING]]

     <li>
      <p>If <var>request</var>'s <a for=request>body</a> is non-null, and <var>request</var>'s
      <a for=request>body</a>'s <a for=body>source</a> is null, then the user agent may have a
      buffer of up to 64 kibibytes and store a part of <var>request</var>'s <a for=request>body</a>
      in that buffer. If the user agent reads from <var>request</var>'s <a for=request>body</a>
      beyond that buffer's size and the user agent needs to resend <var>request</var>, then instead
      return a <a>network error</a>.

      <div class=note>
       <p>The resending is needed when the connection is timed out, for example.

       <p>The buffer is not needed when <var>request</var>'s <a for=request>body</a>'s
       <a for=body>source</a> is non-null, because <var>request</var>'s <a for=request>body</a> can
       be recreated from it.

       <p>When <var>request</var>'s <a for=request>body</a>'s <a for=body>source</a> is null, it
       means <a for=request>body</a> is created from a {{ReadableStream}} object, which means
       <a for=request>body</a> cannot be recreated and that is why the buffer is needed.
      </div>

     <li>
      <p>While true:

      <ol>
       <li><p>If <var>timingInfo</var>'s
       <a for="fetch timing info">final network-response start time</a> is 0, then set
       <var>timingInfo</var>'s <a for="fetch timing info">final network-response start time</a> to
       <a for=/>coarsened shared current time</a> given <var>fetchParams</var>'s
       <a for="fetch params">cross-origin isolated capability</a>, immediately after the user
       agent's HTTP parser receives the first byte of the response (e.g., frame header bytes for
       HTTP/2 or response status line for HTTP/1.x).

       <li><p>Wait until all the HTTP response headers are transmitted.

       <li><p>Let <var>status</var> be the HTTP response's status code.

       <li>
        <p>If <var>status</var> is in the range 100 to 199, inclusive:
        <!-- If there comes a time when there is another code besides 101 and 103 that needs special
        processing we should generalize the "process early hints response" callback and invoke it
        for each 1xx response and as such require callers like WebSockets to do the filtering and
        processing we now perform here inline. -->

        <ol>
         <li><p>If <var>request</var>'s <a for=request>mode</a> is "<code>websocket</code>" and
         <var>status</var> is 101, then <a for=iteration>break</a>.

         <li><p>If <var>status</var> is 103 and <var>fetchParams</var>'s
         <a for="fetch params">process early hints response</a> is non-null, then
         <a>queue a fetch task</a> to run <var>fetchParams</var>'s
         <a for="fetch params">process early hints response</a>, with <a for=/>response</a>.

         <li><p><a for=iteration>Continue</a>.
        </ol>

        <p class=note>These kind of HTTP responses are eventually followed by a "final" HTTP
        response.

       <li><p><a for=iteration>Break</a>.
      </ol>
    </ul>

    <p class=note>The exact layering between Fetch and HTTP still needs to be sorted through and
    therefore <var>response</var> represents both a <a for=/>response</a> and
    an HTTP response here.

    <p>If the HTTP request results in a TLS client certificate dialog, then:

    <ol>
     <li><p>If <var>request</var>'s <a for=request>window</a>
     is an <a>environment settings object</a>, make the dialog
     available in <var>request</var>'s
     <a for=request>window</a>.

     <li><p>Otherwise, return a <a>network error</a>.
    </ol>

    <p>To transmit <var>request</var>'s <a for=request>body</a> <var>body</var>, run these steps:

    <ol>
     <li><p>If <var>body</var> is null and <var>fetchParams</var>'s
     <a for="fetch params">process request end-of-body</a> is non-null, then
     <a>queue a fetch task</a> given <var>fetchParams</var>'s
     <a for="fetch params">process request end-of-body</a> and <var>fetchParams</var>'s
     <a for="fetch params">task destination</a>.

     <li>
      <p>Otherwise, if <var>body</var> is non-null:

      <ol>
       <li>
        <p>Let <var>processBodyChunk</var> given <var>bytes</var> be these steps:

        <ol>
         <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then abort these
         steps.

         <li><p>Run this step <a>in parallel</a>: transmit <var>bytes</var>.

         <li><p>If <var>fetchParams</var>'s
         <a for="fetch params">process request body chunk length</a> is non-null, then run
         <var>fetchParams</var>'s <a for="fetch params">process request body chunk length</a> given
         <var>bytes</var>'s <a for="byte sequence">length</a>.
        </ol>

       <li>
        <p>Let <var>processEndOfBody</var> be these steps:

        <ol>
         <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then abort these
         steps.

         <li><p>If <var>fetchParams</var>'s <a for="fetch params">process request end-of-body</a> is
         non-null, then run <var>fetchParams</var>'s
         <a for="fetch params">process request end-of-body</a>.
        </ol>

       <li>
        <p>Let <var>processBodyError</var> given <var>e</var> be these steps:

        <ol>
         <li><p>If <var>fetchParams</var> is <a for="fetch params">canceled</a>, then abort these
         steps.

         <li><p>If <var>e</var> is an "<code><a exception>AbortError</a></code>" {{DOMException}},
         then <a for="fetch controller">abort</a> <var>fetchParams</var>'s
         <a for="fetch params">controller</a>.

         <li><p>Otherwise, <a for="fetch controller">terminate</a> <var>fetchParams</var>'s
         <a for="fetch params">controller</a>.
        </ol>

       <li><p><a for=body>Incrementally read</a> <var>request</var>'s <a for=request>body</a> given
       <var>processBodyChunk</var>, <var>processEndOfBody</var>, <var>processBodyError</var>, and
       <var>fetchParams</var>'s <a for="fetch params">task destination</a>.
       <!-- This obtains a reader in parallel, but it's mostly fine since we already proxied the
            input stream as part of the Request constructor. -->
      </ol>
    </ol>
    <!-- In implementations to date this always happens before a response is processed. -->
  </ol>

 <li>
  <p><a>If aborted</a>, then:

  <ol>
   <li><p>If <var>connection</var> uses HTTP/2, then transmit an <code>RST_STREAM</code> frame.

   <li><p>Return the <a for=/>appropriate network error</a> for <var>fetchParams</var>.
  </ol>

 <li>
  <p>Let |buffer| be an empty buffer that can have bytes appended to it.

  <p class="note">This represents an internal buffer inside the network layer of the user agent.

 <li>
  <p>Let |pullAlgorithm| be the followings steps:

  <ol>
   <li><p>Let |promise| be [=a new promise=].

   <li>
    <p>Run the following steps [=in parallel=]:

    <ol>
     <li><p>If the size of |buffer| is smaller than a lower limit chosen by the user agent and the
     ongoing fetch is [=fetch/suspend|suspended=], [=fetch/resumed|resume=] the fetch.

     <li><p>Wait until |buffer| is not empty.

     <li>
      <p>[=Queue a fetch task=] to run the following steps, with |fetchParams|'s
      [=task destination=].

      <ol>
       <li><p>Let |available| be the size of |buffer|.

       <li><p>Let |desiredSize| be |available|.

       <li><p>If |stream|'s [=ReadableStream/current BYOB request view=] is non-null, then set
       |desiredSize| to |stream|'s [=ReadableStream/current BYOB request view=]'s
       [=BufferSource/byte length=].

       <li><p>Let |extractSize| be the smaller value of |available| and |desiredSize|.

       <li><p>Let <var>bytes</var> be the result of extracting |extractSize| of bytes from
       <var>buffer</var>.

       <li><p>If |stream|s [=ReadableStream/current BYOB request view=] is non-null, then
       [=ArrayBufferView/write=] |bytes| into |stream|'s
       [=ReadableStream/current BYOB request view=], and set |view| to |stream|'s
       [=ReadableStream/current BYOB request view=].

       <li>Otherwise, set |view| to the result of [=ArrayBufferView/create|creating=] a
       {{Uint8Array}} from |bytes| in |stream|'s [=relevant Realm=].

       <li><p>[=ReadableStream/Enqueue=] |view| into |stream|.

       <li><p>If |stream| is [=ReadableStream/errored=], then [=fetch controller/terminate=]
       |fetchParams|'s [=fetch params/controller=].

       <li><p>[=/Resolve=] |promise| with undefined.
      </ol>
    </ol>

   <li><p>Return |promise|.
  </ol>

 <li><p>Let <var>cancelAlgorithm</var> be an algorithm that <a for="fetch controller">aborts</a>
 <var>fetchParams</var>'s <a for="fetch params">controller</a> with <var>reason</var>, given
 <var>reason</var>.

 <li><p>Let <var>stream</var> be a <a>new</a> {{ReadableStream}}.

 <li><p>[=ReadableStream/set up with byte reading support|Set up=] |stream| with byte reading
 support with <var>[=ReadableStream/set up/pullAlgorithm=]</var> set to |pullAlgorithm|,
 <var>[=ReadableStream/set up/cancelAlgorithm=]</var> set to |cancelAlgorithm|.

 <li><p>Set <var>response</var>'s <a for=response>body</a> to a new <a for=/>body</a> whose
 <a for=body>stream</a> is <var>stream</var>.

 <li><p tracking-vector>If <var>includeCredentials</var> is true and the user agent is not
 configured to block cookies for <var>request</var> (see
 <a href=https://httpwg.org/specs/rfc6265.html#privacy-considerations>section 7</a> of
 [[!COOKIES]]), then run the "set-cookie-string" parsing algorithm (see
 <a href=https://httpwg.org/specs/rfc6265.html#set-cookie>section 5.2</a> of [[!COOKIES]]) on the
 <a for=header>value</a> of each <a for=/>header</a> whose <a for=header>name</a> is a
 <a>byte-case-insensitive</a> match for `<code>Set-Cookie</code>` in <var>response</var>'s
 <a for=response>header list</a>, if any, and <var>request</var>'s <a for=request>current URL</a>.

 <li>
  <p>Run these steps <a>in parallel</a>:

  <ol>
   <li>
    <p>Run these steps, but <a>abort when</a> <var>fetchParams</var> is
    <a for="fetch params">canceled</a>:

    <ol>
     <li>
      <p>While true:

      <ol>
       <li>
        <p>If one or more bytes have been transmitted from <var>response</var>'s message body, then:

        <ol>
         <li><p>Let <var>bytes</var> be the transmitted bytes.

         <li><p>Let <var>codings</var> be the result of <a>extracting header list values</a> given
         `<code>Content-Encoding</code>` and <var>response</var>'s <a for=response>header list</a>.

         <li><p>Increase <var>response</var>'s <a for=response>body info</a>'s
         <a for="response body info">encoded size</a> by <var>bytes</var>'s
         <a for="byte sequence">length</a>.

         <li>
          <p>Set <var>bytes</var> to the result of <a lt="handle content codings">handling content
          codings</a> given <var>codings</var> and <var>bytes</var>.

          <p class=note>This makes the `<code>Content-Length</code>` <a for=/>header</a> unreliable
          to the extent that it was reliable to begin with.

         <li><p>Increase <var>response</var>'s <a for=response>body info</a>'s
         <a for="response body info">decoded size</a> by
         <var>bytes</var>'s <a for="byte sequence">length</a>.

         <li><p>If <var>bytes</var> is failure, then <a for="fetch controller">terminate</a>
         <var>fetchParams</var>'s <a for="fetch params">controller</a>.

         <li><p>Append |bytes| to |buffer|.

         <li><p>If the size of |buffer| is larger than an upper limit chosen by the user agent, ask
         the user agent to [=fetch/suspend=] the ongoing fetch.
        </ol>

       <li><p>Otherwise, if the bytes transmission for <var>response</var>'s message body is done
       normally and <var>stream</var> is <a for=ReadableStream>readable</a>, then
       <a for=ReadableStream>close</a> <var>stream</var>, and abort these in-parallel steps.
      </ol>
    </ol>

   <li>
    <p><a>If aborted</a>, then:

    <ol>

     <li>
      <p>If <var>fetchParams</var> is <a for="fetch params">aborted</a>, then:

      <ol>
       <li><p>Set <var>response</var>'s <a for=response>aborted flag</a>.

       <li><p>If <var>stream</var> is <a for=ReadableStream>readable</a>, then
       <a for=ReadableStream>error</a> <var>stream</var> with the result of
       <a>deserialize a serialized abort reason</a> given <var>fetchParams</var>'s
       <a for="fetch params">controller</a>'s <a for="fetch controller">serialized abort reason</a>
       and an <a>implementation-defined</a> <a>realm</a>.
       <!-- XXX: At some point we really need to sort out how JavaScript streams interact with the
            network layer a bit better. -->
      </ol>

     <li><p>Otherwise, if <var>stream</var> is <a for=ReadableStream>readable</a>,
     <a for=ReadableStream>error</a> <var>stream</var> with a {{TypeError}}.

     <li><p>If <var>connection</var> uses HTTP/2, then transmit an <code>RST_STREAM</code> frame.

     <li>
      <p>Otherwise, the user agent should close <var>connection</var> unless it would be bad for
      performance to do so.

      <p class=note>For instance, the user agent could keep the connection open if it knows there's
      only a few bytes of transfer remaining on a reusable connection. In this case it could be
      worse to close the connection and go through the handshake process again for the next fetch.
    </ol>
  </ol>

  <p class=note>These are run <a>in parallel</a> as at this point it is unclear whether
  <var>response</var>'s <a for=response>body</a> is relevant (<var>response</var> might be a
  redirect).

 <li><p>Return <var>response</var>. <span class=note>Typically <var>response</var>'s
 <a for=response>body</a>'s <a for=body>stream</a> is still being enqueued to after
 returning.</span>
</ol>
</div>


<h3 id=cors-preflight-fetch>CORS-preflight fetch</h3>

<p class=note>This is effectively the user agent implementation of the check to see if the
<a>CORS protocol</a> is understood. The so-called <a>CORS-preflight request</a>. If successful it
populates the <a>CORS-preflight cache</a> to minimize the number of these
<a lt="CORS-preflight fetch">fetches</a>.

<div algorithm>
<p>To <dfn id=cors-preflight-fetch-0>CORS-preflight fetch</dfn>, given a <a for=/>request</a>
<var>request</var>, run these steps:

<ol>
 <li>
  <p>Let <var>preflight</var> be a new <a for=/>request</a> whose
  <a for=request>method</a> is `<code>OPTIONS</code>`,
  <a for=request>URL list</a> is a <a for=list>clone</a> of <var>request</var>'s
  <a for=request>URL list</a>,
  <a for=request>initiator</a> is <var>request</var>'s <a for=request>initiator</a>,
  <a for=request>destination</a> is <var>request</var>'s <a for=request>destination</a>,
  <a for=request>origin</a> is <var>request</var>'s <a for=request>origin</a>,
  <a for=request>referrer</a> is <var>request</var>'s <a for=request>referrer</a>,
  <a for=request>referrer policy</a> is <var>request</var>'s <a for=request>referrer policy</a>,
  <a for=request>mode</a> is "<code>cors</code>", and
  <a for=request>response tainting</a> is "<code>cors</code>".

  <p class=note>The <a for=request>service-workers mode</a> of <var>preflight</var> does not matter
  as this algorithm uses <a>HTTP-network-or-cache fetch</a> rather than <a>HTTP fetch</a>.

 <li><p><a for="header list">Append</a> (`<code>Accept</code>`, `<code>*/*</code>`) to
 <var>preflight</var>'s <a for=request>header list</a>.

 <li><p><a for="header list">Append</a>
 (`<a http-header><code>Access-Control-Request-Method</code></a>`, <var>request</var>'s
 <a for=request>method</a>) to <var>preflight</var>'s <a for=request>header list</a>.

 <li><p>Let <var>headers</var> be the <a>CORS-unsafe request-header names</a> with
 <var>request</var>'s <a for=request>header list</a>.

 <li>
  <p>If <var>headers</var> <a for=list>is not empty</a>, then:

  <ol>
   <li><p>Let <var>value</var> be the items in <var>headers</var> separated from each other by
   `<code>,</code>`.

   <li><p><a for="header list">Append</a>
   (`<a http-header><code>Access-Control-Request-Headers</code></a>`, <var>value</var>) to
   <var>preflight</var>'s <a for=request>header list</a>.
  </ol>

  <p class=note>This intentionally does not use <a for="header list">combine</a>, as 0x20 following
  0x2C is not the way this was implemented, for better or worse.

 <li><p>Let <var>response</var> be the result of running <a>HTTP-network-or-cache fetch</a> given
 a new <a for=/>fetch params</a> whose <a for="fetch params">request</a> is <var>preflight</var>.

 <li>
  <p>If a <a>CORS check</a> for <var>request</var> and <var>response</var> returns success and
  <var>response</var>'s <a for=response>status</a> is an <a>ok status</a>, then:
  <!-- CORS said 200 here but nobody implemented that:
       https://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0078.html -->

  <p class=note>The <a>CORS check</a> is done on <var>request</var> rather than <var>preflight</var>
  to ensure the correct <a for=request>credentials mode</a> is used.

  <ol>
   <li><p>Let <var>methods</var> be the result of <a>extracting header list values</a> given
   `<a http-header><code>Access-Control-Allow-Methods</code></a>` and <var>response</var>'s
   <a for=response>header list</a>.

   <li><p>Let <var>headerNames</var> be the result of <a>extracting header list values</a> given
   `<a http-header><code>Access-Control-Allow-Headers</code></a>` and <var>response</var>'s
   <a for=response>header list</a>.

   <li><p>If either <var>methods</var> or <var>headerNames</var> is failure,
   return a <a>network error</a>.

   <li>
    <p>If <var>methods</var> is null and <var>request</var>'s <a>use-CORS-preflight flag</a>
    is set, then set <var>methods</var> to a new list containing <var>request</var>'s
    <a for=request>method</a>.

    <p class=note>This ensures that a <a>CORS-preflight fetch</a> that happened due to
    <var>request</var>'s <a>use-CORS-preflight flag</a> being set is
    <a lt="CORS-preflight cache">cached</a>.

   <li><p>If <var>request</var>'s <a for=request>method</a> is not in <var>methods</var>,
   <var>request</var>'s <a for=request>method</a> is not a <a>CORS-safelisted method</a>, and
   <var>request</var>'s <a for=request>credentials mode</a> is "<code>include</code>" or
   <var>methods</var> does not contain `<code>*</code>`, then return a <a>network error</a>.

   <li><p>If one of <var>request</var>'s <a for=request>header list</a>'s
   <a lt=name for=header>names</a> is a <a>CORS non-wildcard request-header name</a> and is not a
   <a>byte-case-insensitive</a> match for an <a for=list>item</a> in <var>headerNames</var>, then
   return a <a>network error</a>.

   <li><p><a for=list>For each</a> <var>unsafeName</var> of the
   <a>CORS-unsafe request-header names</a> with <var>request</var>'s
   <a for=request>header list</a>, if <var>unsafeName</var> is not a <a>byte-case-insensitive</a>
   match for an <a for=list>item</a> in <var>headerNames</var> and <var>request</var>'s
   <a for=request>credentials mode</a> is "<code>include</code>" or <var>headerNames</var> does not
   contain `<code>*</code>`, return a <a>network error</a>.

   <li><p>Let <var>max-age</var> be the result of <a>extracting header list values</a> given
   `<a http-header><code>Access-Control-Max-Age</code></a>` and <var>response</var>'s
   <a for=response>header list</a>.

   <li><p>If <var>max-age</var> is failure or null, then set <var>max-age</var> to 5.

   <li><p>If <var>max-age</var> is greater than an imposed limit on
   <a for="cache entry">max-age</a>, then set <var>max-age</var> to the imposed limit.

   <li><p>If the user agent does not provide for a <a lt="CORS-preflight cache">cache</a>, then
   return <var>response</var>.

   <li><p>For each <var>method</var> in <var>methods</var> for which there is a
   <a>method cache entry match</a> using <var>request</var>, set matching entry's
   <a for="cache entry">max-age</a> to <var>max-age</var>.

   <li><p>For each <var>method</var> in <var>methods</var> for which there is no
   <a>method cache entry match</a> using <var>request</var>, <a>create a new cache entry</a> with
   <var>request</var>, <var>max-age</var>, <var>method</var>, and null.

   <li><p>For each <var>headerName</var> in <var>headerNames</var> for which there is a
   <a>header-name cache entry match</a> using <var>request</var>, set matching entry's
   <a for="cache entry">max-age</a> to <var>max-age</var>.

   <li><p>For each <var>headerName</var> in <var>headerNames</var> for which there is no
   <a>header-name cache entry match</a> using <var>request</var>, <a>create a new cache entry</a>
   with <var>request</var>, <var>max-age</var>, null, and <var>headerName</var>.

   <li><p>Return <var>response</var>.
  </ol>

 <li><p>Otherwise, return a <a>network error</a>.
</ol>
</div>


<h3 id=cors-preflight-cache>CORS-preflight cache</h3>

<p>A user agent has an associated <a>CORS-preflight cache</a>. A
<dfn id=concept-cache>CORS-preflight cache</dfn> is a <a for=/>list</a> of <a>cache entries</a>.

<p>A <dfn>cache entry</dfn> consists of:

<ul class=brief>
 <li><dfn id=concept-cache-key for="cache entry">key</dfn> (a <a for=/>network partition key</a>)
 <li><dfn id=concept-cache-origin for="cache entry">byte-serialized origin</dfn> (a
 <a for=/>byte sequence</a>)
 <li><dfn id=concept-cache-url for="cache entry">URL</dfn> (a <a for=/>URL</a>)
 <li><dfn id=concept-cache-max-age for="cache entry">max-age</dfn> (a number of seconds)
 <li><dfn id=concept-cache-credentials for="cache entry">credentials</dfn> (a boolean)
 <li><dfn id=concept-cache-method for="cache entry">method</dfn> (null, `<code>*</code>`, or a
 <a for=/>method</a>)
 <li><dfn id=concept-cache-header-name for="cache entry">header name</dfn> (null, `<code>*</code>`,
 or a <a for=/>header name</a>)
</ul>

<p><a>Cache entries</a> must be removed after the seconds specified in their
<a for="cache entry">max-age</a> field have passed since storing the entry. <a>Cache entries</a> may
be removed before that moment arrives.

<div algorithm>
<p>To <dfn id=concept-cache-create-entry>create a new cache entry</dfn>, given <var>request</var>,
<var>max-age</var>, <var>method</var>, and <var>headerName</var>, run these steps:

<ol>
 <li>
  <p>Let <var>entry</var> be a <a>cache entry</a>, initialized as follows:

  <dl>
   <dt><a for="cache entry">key</a>
   <dd><p>The result of <a for=request>determining the network partition key</a> given
   <var>request</var>

   <dt><a for="cache entry">byte-serialized origin</a>
   <dd><p>The result of <a>byte-serializing a request origin</a> with <var>request</var>

   <dt><a for="cache entry">URL</a>
   <dd><p><var>request</var>'s <a for=request>current URL</a>

   <dt><a for="cache entry">max-age</a>
   <dd><p><var>max-age</var>

   <dt><a for="cache entry">credentials</a>
   <dd><p>True if <var>request</var>'s <a for=request>credentials mode</a> is
   "<code>include</code>", and false otherwise

   <dt><a for="cache entry">method</a>
   <dd><p><var>method</var>

   <dt><a for="cache entry">header name</a>
   <dd><p><var>headerName</var>
  </dl>

 <li><p><a for=list>Append</a> <var>entry</var> to the user agent's <a>CORS-preflight cache</a>.
</ol>
</div>

<p>To <dfn id=concept-cache-clear>clear cache entries</dfn>, given a <var>request</var>,
<a for=list>remove</a> any <a>cache entries</a> in the user agent's <a>CORS-preflight cache</a>
whose <a for="cache entry">key</a> is the result of
<a for=request>determining the network partition key</a> given <var>request</var>,
<a for="cache entry">byte-serialized origin</a> is the result of
<a>byte-serializing a request origin</a> with <var>request</var>, and <a for="cache entry">URL</a>
is <var>request</var>'s <a for=request>current URL</a>.

<p>There is a <dfn id=concept-cache-match>cache entry match</dfn> for a <a>cache entry</a>
<var>entry</var> with <var>request</var> if <var>entry</var>'s <a for="cache entry">key</a> is the
result of <a for=request>determining the network partition key</a> given <var>request</var>,
<var>entry</var>'s <a for="cache entry">byte-serialized origin</a> is the result of
<a>byte-serializing a request origin</a> with <var>request</var>, <var>entry</var>'s
<a for="cache entry">URL</a> is <var>request</var>'s <a for=request>current URL</a>, and one of

<ul class=brief>
 <li><var>entry</var>'s <a for="cache entry">credentials</a> is true
 <li><var>entry</var>'s <a for="cache entry">credentials</a> is false and <var>request</var>'s
 <a for=request>credentials mode</a> is not "<code>include</code>".
</ul>

<p>is true.

<p>There is a <dfn id=concept-cache-match-method>method cache entry match</dfn> for
<var>method</var> using <var>request</var> when there is a <a>cache entry</a> in the user agent's
<a>CORS-preflight cache</a> for which there is a <a>cache entry match</a> with <var>request</var>
and its <a for="cache entry">method</a> is <var>method</var> or `<code>*</code>`.

<p>There is a <dfn id=concept-cache-match-header>header-name cache entry match</dfn> for
<var>headerName</var> using <var>request</var> when there is a <a>cache entry</a> in the user
agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a> with
<var>request</var> and one of

<ul class=brief>
 <li>its <a for="cache entry">header name</a> is a <a>byte-case-insensitive</a> match for
 <var>headerName</var>
 <li>its <a for="cache entry">header name</a> is `<code>*</code>` and <var>headerName</var> is not
 a <a>CORS non-wildcard request-header name</a>
</ul>

<p>is true.


<h3 id=cors-check>CORS check</h3>

<div algorithm>
<p>To perform a <dfn id=concept-cors-check>CORS check</dfn> for a <var>request</var> and
<var>response</var>, run these steps:

<ol>
 <li><p>Let <var>origin</var> be the result of <a for="header list">getting</a>
 `<a http-header><code>Access-Control-Allow-Origin</code></a>` from <var>response</var>'s
 <a for=response>header list</a>.

 <li>
  <p>If <var>origin</var> is null, then return failure.

  <p class=note>Null is not `<code>null</code>`.

 <li><p>If <var>request</var>'s <a for=request>credentials mode</a> is not "<code>include</code>"
 and <var>origin</var> is `<code>*</code>`, then return success.

 <li><p>If the result of <a>byte-serializing a request origin</a> with <var>request</var> is not
 <var>origin</var>, then return failure.

 <li><p>If <var>request</var>'s <a for=request>credentials mode</a> is not "<code>include</code>",
 then return success.

 <li><p>Let <var>credentials</var> be the result of <a for="header list">getting</a>
 `<a http-header><code>Access-Control-Allow-Credentials</code></a>` from <var>response</var>'s
 <a for=response>header list</a>.

 <li><p>If <var>credentials</var> is `<code>true</code>`, then return success.

 <li><p>Return failure.
</ol>
</div>


<h3 id=tao-check>TAO check</h3>

<div algorithm>
<p>To perform a <dfn id=concept-tao-check>TAO check</dfn> for a <var>request</var> and
<var>response</var>, run these steps:

<ol>
 <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is set, then return
 failure.

 <li><p>Let <var>values</var> be the result of
 <a for="header list">getting, decoding, and splitting</a> `<code>Timing-Allow-Origin</code>` from
 <var>response</var>'s <a for=response>header list</a>.

 <li><p>If <var>values</var> <a for=list>contains</a> "<code>*</code>", then return success.

 <li><p>If <var>values</var> <a for=list>contains</a> the result of
 <a>serializing a request origin</a> with <var>request</var>, then return success.

 <li>
  <p>If <var>request</var>'s <a for=request>mode</a> is "<code>navigate</code>" and
  <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> is not
  <a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, then return failure.

  <p class=note>This is necessary for navigations of a nested navigable. There,
  <var>request</var>'s <a for=request>origin</a> would be the container document's
  <a for=Document>origin</a> and the <a>TAO check</a> would return failure. Since navigation timing
  never validates the results of the <a>TAO check</a>, the nested document would still have access
  to the full timing information, but the container document would not.

 <li><p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>basic</code>", then
 return success.

 <li><p>Return failure.
</ol>
</div>



<h2 id=fetch-api>Fetch API</h2>

<p class=note>The <a method><code>fetch()</code></a> method is relatively low-level API for
<a lt=fetch for=/>fetching</a> resources. It covers slightly more ground than {{XMLHttpRequest}},
although it is currently lacking when it comes to request progression (not response progression).

<div class=example id=fetch-blob-example>
 <p>The <a method><code>fetch()</code></a> method makes it quite straightforward to
 <a for=/>fetch</a> a resource and extract its contents as a {{Blob}}:

 <pre><code class=lang-javascript>
fetch("/music/pk/altes-kamuffel.flac")
  .then(res => res.blob()).then(playBlob)
</code></pre>

 <p>If you just care to log a particular response header:

 <pre><code class=lang-javascript>
fetch("/", {method:"HEAD"})
  .then(res => log(res.headers.get("strict-transport-security")))
</code></pre>

 <p>If you want to check a particular response header and then process the response of a
 cross-origin resource:

 <pre><code class=lang-javascript>
fetch("https://pk.example/berlin-calling.json", {mode:"cors"})
  .then(res => {
    if(res.headers.get("content-type") &amp;&amp;
       res.headers.get("content-type").toLowerCase().indexOf("application/json") >= 0) {
      return res.json()
    } else {
      throw new TypeError()
    }
  }).then(processJSON)
</code></pre>

 <p>If you want to work with URL query parameters:

 <pre><code class=lang-javascript>
var url = new URL("https://geo.example.org/api"),
    params = {lat:35.696233, long:139.570431}
Object.keys(params).forEach(key => url.searchParams.append(key, params[key]))
fetch(url).then(/* … */)
</code></pre>

 <p>If you want to receive the body data progressively:

 <pre><code class=lang-javascript>
function consume(reader) {
  var total = 0
  return pump()
  function pump() {
    return reader.read().then(({done, value}) => {
      if (done) {
        return
      }
      total += value.byteLength
      log(`received ${value.byteLength} bytes (${total} bytes in total)`)
      return pump()
    })
  }
}

fetch("/music/pk/altes-kamuffel.flac")
  .then(res => consume(res.body.getReader()))
  .then(() => log("consumed the entire body without keeping the whole thing in memory!"))
  .catch(e => log("something went wrong: " + e))
</code></pre>
</div>


<h3 id=headers-class>Headers class</h3>

<pre class=idl>
typedef (sequence&lt;sequence&lt;ByteString>> or record&lt;ByteString, ByteString>) HeadersInit;

[Exposed=(Window,Worker)]
interface Headers {
  constructor(optional HeadersInit init);

  undefined append(ByteString name, ByteString value);
  undefined delete(ByteString name);
  ByteString? get(ByteString name);
  sequence&lt;ByteString> getSetCookie();
  boolean has(ByteString name);
  undefined set(ByteString name, ByteString value);
  iterable&lt;ByteString, ByteString>;
};
</pre>

<p>A {{Headers}} object has an associated
<dfn export for=Headers id=concept-headers-header-list>header list</dfn> (a
<a for=/>header list</a>), which is initially empty. <span class=note>This
can be a pointer to the <a for=/>header list</a> of something else, e.g.,
of a <a for=/>request</a> as demonstrated by {{Request}}
objects.</span>

<p>A {{Headers}} object also has an associated
<dfn export for=Headers id=concept-headers-guard>guard</dfn>, which is a <dfn>headers guard</dfn>. A
<a for=/>headers guard</a> is "<code>immutable</code>", "<code>request</code>",
"<code>request-no-cors</code>", "<code>response</code>" or "<code>none</code>".

<hr>

<dl class=domintro>
 <dt><code><var>headers</var> = new <a constructor lt="Headers()">Headers</a>([<var>init</var>])</code>
 <dd>
  <p>Creates a new {{Headers}} object. <var>init</var> can be used to fill its internal header list,
  as per the example below.

  <div class=example id=example-headers-class>
   <pre><code class=lang-javascript>
const meta = { "Content-Type": "text/xml", "Breaking-Bad": "&lt;3" };
new Headers(meta);

// The above is equivalent to
const meta2 = [
  [ "Content-Type", "text/xml" ],
  [ "Breaking-Bad", "&lt;3" ]
];
new Headers(meta2);
</code></pre>
  </div>

 <dt><code><var>headers</var> . <a method for=Headers lt=append()>append</a>(<var>name</var>, <var>value</var>)</code>
 <dd><p>Appends a header to <var>headers</var>.

 <dt><code><var>headers</var> . <a method for=Headers lt=delete()>delete</a>(<var>name</var>)</code>
 <dd><p>Removes a header from <var>headers</var>.

 <dt><code><var>headers</var> . <a method for=Headers lt=get()>get</a>(<var>name</var>)</code>
 <dd><p>Returns as a string the values of all headers whose name is <var>name</var>, separated by a
 comma and a space.

 <dt><code><var>headers</var> . <a method for=Headers lt=getSetCookie()>getSetCookie</a>()</code>
 <dd><p>Returns a list of the values for all headers whose name is `<code>Set-Cookie</code>`.

 <dt><code><var>headers</var> . <a method for=Headers lt=has()>has</a>(<var>name</var>)</code>
 <dd><p>Returns whether there is a header whose name is <var>name</var>.

 <dt><code><var>headers</var> . <a method for=Headers lt=set()>set</a>(<var>name</var>, <var>value</var>)</code>
 <dd><p>Replaces the value of the first header whose name is <var>name</var> with <var>value</var>
 and removes any remaining headers whose name is <var>name</var>.

 <dt><code>for(const [<var>name</var>, <var>value</var>] of <var>headers</var>)</code>
 <dd><p><var>headers</var> can be iterated over.
</dl>

<hr>

<div algorithm>
<p>To <dfn for=Headers>validate</dfn> a  <a for=/>header</a> (<var>name</var>, <var>value</var>) for
a {{Headers}} object <var>headers</var>:

<ol>
 <li><p>If <var>name</var> is not a <a for=/>header name</a> or <var>value</var> is not a
 <a for=/>header value</a>, then <a>throw</a> a {{TypeError}}.

 <li><p>If <var>headers</var>'s <a for=Headers>guard</a> is "<code>immutable</code>", then
 <a>throw</a> a {{TypeError}}.

 <li><p>If <var>headers</var>'s <a for=Headers>guard</a> is "<code>request</code>" and
 (<var>name</var>, <var>value</var>) is a <a>forbidden request-header</a>, then return false.

 <li><p>If <var>headers</var>'s <a for=Headers>guard</a> is "<code>response</code>" and
 <var>name</var> is a <a>forbidden response-header name</a>, then return false.

 <li><p>Return true.
</ol>
</div>

<p class=note>Steps for "<code>request-no-cors</code>" are not shared as you cannot have a fake
value (for {{Headers/delete()}}) that always succeeds in <a>CORS-safelisted request-header</a>.

<div algorithm>
<p>To <dfn export for=Headers id=concept-headers-append>append</dfn> a <a for=/>header</a>
(<var>name</var>, <var>value</var>) to a {{Headers}} object <var>headers</var>, run these steps:

<ol>
 <li><p><a for="header value">Normalize</a> <var>value</var>.

 <li><p>If <a for=Headers>validating</a> (<var>name</var>, <var>value</var>) for <var>headers</var>
 returns false, then return.

 <li>
  <p>If <var>headers</var>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>":

  <ol>
   <li><p>Let <var>temporaryValue</var> be the result of <a for="header list">getting</a>
   <var>name</var> from <var>headers</var>'s <a for=Headers>header list</a>.

   <li><p>If <var>temporaryValue</var> is null, then set <var>temporaryValue</var> to
   <var>value</var>.

   <li><p>Otherwise, set <var>temporaryValue</var> to <var>temporaryValue</var>, followed by
   0x2C 0x20, followed by <var>value</var>.

   <li><p>If (<var>name</var>, <var>temporaryValue</var>) is not a
   <a>no-CORS-safelisted request-header</a>, then return.
  </ol>

 <li><p><a for="header list">Append</a> (<var>name</var>, <var>value</var>) to <var>headers</var>'s
 <a for=Headers>header list</a>.

 <li><p>If <var>headers</var>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>", then
 <a for=Headers>remove privileged no-CORS request-headers</a> from <var>headers</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn export for=Headers id=concept-headers-fill>fill</dfn> a {{Headers}} object
<var>headers</var> with a given object <var>object</var>, run these steps:

<ol>
 <li>
  <p>If <var>object</var> is a <a>sequence</a>, then <a for=list>for each</a> <var>header</var> of
  <var>object</var>:

  <ol>
   <li><p>If <var>header</var>'s <a for=list>size</a> is not 2, then <a>throw</a> a {{TypeError}}.

   <li><p><a for=Headers>Append</a> (<var>header</var>[0], <var>header</var>[1]) to
   <var>headers</var>.
  </ol>

 <li><p>Otherwise, <var>object</var> is a <a for=/>record</a>, then <a for=map>for each</a>
 <var>key</var> → <var>value</var> of <var>object</var>, <a for=Headers>append</a> (<var>key</var>,
 <var>value</var>) to <var>headers</var>.
</ol>
</div>

<div algorithm>
<p>To
<dfn for=Headers id=concept-headers-remove-privileged-no-cors-request-headers>remove privileged no-CORS request-headers</dfn>
from a {{Headers}} object (<var>headers</var>), run these steps:

<ol>
 <li><p><a for="list">For each</a> <var>headerName</var> of
 <a>privileged no-CORS request-header names</a>:

 <ol>
  <li><p><a for="header list">Delete</a> <var>headerName</var> from <var>headers</var>'s
  <a for=Headers>header list</a>.
 </ol>
</ol>

<p class=note>This is called when headers are modified by unprivileged code.
</div>

<div algorithm>
<p>The
<dfn id=dom-headers export for=Headers constructor lt="Headers(init)"><code>new Headers(<var>init</var>)</code></dfn>
constructor steps are:

<ol>
 <li><p>Set <a>this</a>'s <a for=Headers>guard</a> to "<code>none</code>".

 <li><p>If <var>init</var> is given, then <a for=Headers>fill</a> <a>this</a> with <var>init</var>.
</ol>
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>append(<var>name</var>, <var>value</var>)</code></dfn>
method steps are to <a for=Headers>append</a> (<var>name</var>, <var>value</var>) to <a>this</a>.
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>delete(<var>name</var>)</code></dfn> method steps are:

<ol>
 <li>
  <p>If <a for=Headers>validating</a> (<var>name</var>, ``) for <a>this</a> returns false, then
  return.

  <p class=note>Passing a dummy <a>header value</a> ought not to have any negative repercussions.

 <li><p>If <a>this</a>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>", <var>name</var>
 is not a <a>no-CORS-safelisted request-header name</a>, and <var>name</var> is not a
 <a>privileged no-CORS request-header name</a>, then return.

 <li><p>If <a>this</a>'s <a for=Headers>header list</a> <a for="header list">does not contain</a>
 <var>name</var>, then return.
 <!-- This is intentional to avoid hitting the last step. -->

 <li><p><a for="header list">Delete</a> <var>name</var> from <a>this</a>'s
 <a for=Headers>header list</a>.

 <li><p>If <a>this</a>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>", then
 <a for=Headers>remove privileged no-CORS request-headers</a> from <a>this</a>.
</ol>
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>get(<var>name</var>)</code></dfn> method steps are:

<ol>
 <li><p>If <var>name</var> is not a <a for=/>header name</a>, then <a>throw</a> a {{TypeError}}.

 <li><p>Return the result of <a for="header list">getting</a> <var>name</var> from <a>this</a>'s
 <a for=Headers>header list</a>.
</ol>
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>getSetCookie()</code></dfn> method steps are:

<ol>
 <li><p>If <a>this</a>'s <a for=Headers>header list</a> <a for="header list">does not contain</a>
 `<code>Set-Cookie</code>`, then return « ».

 <li><p>Return the <a lt=value for=header>values</a> of all <a for=/>headers</a> in <a>this</a>'s
 <a for=Headers>header list</a> whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match
 for `<code>Set-Cookie</code>`, in order.
</ol>
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>has(<var>name</var>)</code></dfn> method steps are:

<ol>
 <li><p>If <var>name</var> is not a <a for=/>header name</a>, then <a>throw</a> a {{TypeError}}.

 <li><p>Return true if <a>this</a>'s <a for=Headers>header list</a>
 <a for="header list">contains</a> <var>name</var>; otherwise false.
</ol>
</div>

<div algorithm>
<p>The <dfn export for=Headers method><code>set(<var>name</var>, <var>value</var>)</code></dfn>
method steps are:

<ol>
 <li><p><a for="header value">Normalize</a> <var>value</var>.

 <li><p>If <a for=Headers>validating</a> (<var>name</var>, <var>value</var>) for <a>this</a> returns
 false, then return.

 <li><p>If <a>this</a>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>" and
 (<var>name</var>, <var>value</var>) is not a <a>no-CORS-safelisted request-header</a>, then return.

 <li><p><a for="header list">Set</a> (<var>name</var>, <var>value</var>) in <a>this</a>'s
 <a for=Headers>header list</a>.

 <li><p>If <a>this</a>'s <a for=Headers>guard</a> is "<code>request-no-cors</code>", then
 <a for=Headers>remove privileged no-CORS request-headers</a> from <a>this</a>.
</ol>
</div>

<p>The <a>value pairs to iterate over</a> are the return value of running
<a for="header list">sort and combine</a> with <a>this</a>'s <a for=Headers>header list</a>.


<h3 id=bodyinit-unions>BodyInit unions</h3>

<pre class=idl>
typedef (Blob or BufferSource or FormData or URLSearchParams or USVString) XMLHttpRequestBodyInit;

typedef (ReadableStream or XMLHttpRequestBodyInit) BodyInit;</pre>

<p>To <dfn for=BodyInit export>safely extract</dfn> a <a for=/>body with type</a> from a
<a for=/>byte sequence</a> or {{BodyInit}} object <var>object</var>, run these steps:

<ol>
 <li>
  <p>If <var>object</var> is a {{ReadableStream}} object, then:

  <ol>
   <li><p>Assert: <var>object</var> is neither <a for=ReadableStream>disturbed</a> nor
   <a for=ReadableStream>locked</a>.
  </ol>

 <li><p>Return the result of <a for=BodyInit>extracting</a> <var>object</var>.
</ol>

<p class=note>The <a for=BodyInit>safely extract</a> operation is a subset of the
<a for=BodyInit>extract</a> operation that is guaranteed to not throw an exception.

<p>To <dfn id=concept-bodyinit-extract for=BodyInit export>extract</dfn> a
<a for=/>body with type</a> from a <a for=/>byte sequence</a> or {{BodyInit}} object
<var>object</var>, with an optional boolean
<dfn id=keepalive for=BodyInit/extract export><var>keepalive</var></dfn> (default false), run these
steps:

<ol>
 <li><p>Let <var>stream</var> be null.

 <li><p>If <var>object</var> is a {{ReadableStream}} object, then set <var>stream</var> to
 <var>object</var>.

 <li><p>Otherwise, if <var>object</var> is a {{Blob}} object, set <var>stream</var> to the result of
 running <var>object</var>'s <a for=Blob>get stream</a>.

 <li><p>Otherwise, set <var>stream</var> to a <a>new</a> {{ReadableStream}} object, and
 [=ReadableStream/set up with byte reading support|set up=] <var>stream</var> with byte reading
 support.

 <li><p><a for=/>Assert</a>: <var>stream</var> is a {{ReadableStream}} object.

 <li><p>Let <var>action</var> be null.

 <li><p>Let <var>source</var> be null.

 <li><p>Let <var>length</var> be null.

 <li><p>Let <var>type</var> be null.

 <li>
  <p>Switch on <var>object</var>:

  <dl class=switch>
   <dt>{{Blob}}
   <dd>
    <p>Set <var>source</var> to <var>object</var>.

    <p>Set <var>length</var> to <var>object</var>'s {{Blob/size}}.

    <p>If <var>object</var>'s {{Blob/type}}
    attribute is not the empty byte sequence, set <var>type</var> to its value.
    <!-- Blob reading is not defined and blobs don't have an internal data model to poke at -->

   <dt><a for=/>byte sequence</a>
   <dd><p>Set <var>source</var> to <var>object</var>.

   <dt>{{BufferSource}}
   <dd><p>Set <var>source</var> to a <a lt="get a copy of the buffer source">copy of the bytes</a>
   held by <var>object</var>.

   <dt>{{FormData}}
   <dd>
    <p>Set <var>action</var> to this step: run the
    <a><code>multipart/form-data</code> encoding algorithm</a>, with <var>object</var>'s
    <a for=FormData>entry list</a> and <a>UTF-8</a>.

    <p>Set <var>source</var> to <var>object</var>.

    <p>Set <var>length</var> to <span class=XXX>unclear, see
    <a href="https://github.com/whatwg/html/issues/6424">html/6424</a> for improving this</span>.

    <p>Set <var>type</var> to `<code>multipart/form-data; boundary=</code>`, followed by the
    <a><code>multipart/form-data</code> boundary string</a> generated by the
    <a><code>multipart/form-data</code> encoding algorithm</a>.

   <dt>{{URLSearchParams}}
   <dd>
    <p>Set <var>source</var> to the result of running the
    <a lt="urlencoded serializer"><code>application/x-www-form-urlencoded</code> serializer</a> with
    <var>object</var>'s <a for=URLSearchParams>list</a>.

    <p>Set <var>type</var> to
    `<code>application/x-www-form-urlencoded;charset=UTF-8</code>`.

   <dt><a for=/>scalar value string</a>
   <dd>
    <p>Set <var>source</var> to the <a>UTF-8 encoding</a> of <var>object</var>.

    <p>Set <var>type</var> to `<code>text/plain;charset=UTF-8</code>`.

   <dt>{{ReadableStream}}
   <dd>
    <p>If <var>keepalive</var> is true, then <a>throw</a> a {{TypeError}}.

    <p>If <var>object</var> is <a for=ReadableStream>disturbed</a> or
    <a for=ReadableStream>locked</a>, then <a>throw</a> a {{TypeError}}.
  </dl>

 <li><p>If <var>source</var> is a <a for=/>byte sequence</a>, then set <var>action</var> to a step
 that returns <var>source</var> and <var>length</var> to <var>source</var>'s
 <a for="byte sequence">length</a>.

 <li>
  <p>If <var>action</var> is non-null, then run these steps <a>in parallel</a>:

  <ol>
   <li>
    <p>Run <var>action</var>.

    <p>Whenever one or more bytes are available and <var>stream</var> is not
    <a for=ReadableStream>errored</a>, <a for=ReadableStream>enqueue</a> a {{Uint8Array}} wrapping
    an {{ArrayBuffer}} containing the available bytes into <var>stream</var>.

    <p>When running <var>action</var> is done, <a for=ReadableStream>close</a> <var>stream</var>.
  </ol>

 <li><p>Let <var>body</var> be a <a for=/>body</a> whose <a for=body>stream</a> is
 <var>stream</var>, <a for=body>source</a> is <var>source</var>, and <a for=body>length</a> is
 <var>length</var>.

 <li><p>Return (<var>body</var>, <var>type</var>).
</ol>


<h3 id=body-mixin>Body mixin</h3>

<pre class=idl>
interface mixin Body {
  readonly attribute ReadableStream? body;
  readonly attribute boolean bodyUsed;
  [NewObject] Promise&lt;ArrayBuffer> arrayBuffer();
  [NewObject] Promise&lt;Blob> blob();
  [NewObject] Promise&lt;FormData> formData();
  [NewObject] Promise&lt;any> json();
  [NewObject] Promise&lt;USVString> text();
};</pre>

<p class=note>Formats you would not want a network layer to be dependent upon, such as
HTML, will likely not be exposed here. Rather, an HTML parser API might accept a stream in
due course.
<!-- https://lists.w3.org/Archives/Public/public-whatwg-archive/2014Jun/thread.html#msg72 -->

<p>Objects including the {{Body}} interface mixin need to define an associated
<dfn id=concept-body-mime-type for=Body>MIME type</dfn> algorithm which takes no arguments and
returns failure or a <a for=/>MIME type</a>.

<p>Objects including the {{Body}} interface mixin have an associated
<dfn id=concept-body-body for=Body>body</dfn> (null or a <a for=/>body</a>).

<p>An object including the {{Body}} interface mixin is said to be
<dfn export for=Body>unusable</dfn> if its <a for=Body>body</a> is non-null and its
<a for=Body>body</a>'s <a for=body>stream</a> is <a for=ReadableStream>disturbed</a> or
<a for=ReadableStream>locked</a>.

<hr>

<dl class=domintro>
 <dt><code><var>requestOrResponse</var> . <a attribute for=Body>body</a></code>
 <dd><p>Returns <var>requestOrResponse</var>'s body as {{ReadableStream}}.

 <dt><code><var>requestOrResponse</var> . <a attribute for=Body>bodyUsed</a></code>
 <dd><p>Returns whether <var>requestOrResponse</var>'s body has been read from.

 <dt><code><var>requestOrResponse</var> . <a method for=Body>arrayBuffer</a>()</code>
 <dd><p>Returns a promise fulfilled with <var>requestOrResponse</var>'s body as {{ArrayBuffer}}.

 <dt><code><var>requestOrResponse</var> . <a method for=Body>blob</a>()</code>
 <dd><p>Returns a promise fulfilled with <var>requestOrResponse</var>'s body as {{Blob}}.

 <dt><code><var>requestOrResponse</var> . <a method for=Body>formData</a>()</code>
 <dd><p>Returns a promise fulfilled with <var>requestOrResponse</var>'s body as {{FormData}}.

 <dt><code><var>requestOrResponse</var> . <a method for=Body>json</a>()</code>
 <dd><p>Returns a promise fulfilled with <var>requestOrResponse</var>'s body parsed as JSON.

 <dt><code><var>requestOrResponse</var> . <a method for=Body>text</a>()</code>
 <dd><p>Returns a promise fulfilled with <var>requestOrResponse</var>'s body as string.
</dl>

<hr>

<div algorithm>
<p>The <dfn attribute for=Body><code>body</code></dfn> getter steps are to return null if
<a>this</a>'s <a for=Body>body</a> is null; otherwise <a>this</a>'s <a for=Body>body</a>'s
<a for=body>stream</a>.
</div>

<div algorithm>
<p>The <dfn attribute for=Body><code>bodyUsed</code></dfn> getter steps are to return true if
<a>this</a>'s <a for=Body>body</a> is non-null and <a>this</a>'s <a for=Body>body</a>'s
<a for=body>stream</a> is <a for=ReadableStream>disturbed</a>; otherwise false.
</div>

<div algorithm>
<p id=concept-body-package-data>The <dfn id=concept-body-consume-body for=Body>consume body</dfn>
algorithm, given an object that includes {{Body}} <var>object</var> and an algorithm that takes a
<a for=/>byte sequence</a> and returns a JavaScript value or throws an exception
<var>convertBytesToJSValue</var>, runs these steps:

<ol>
 <li><p>If <var>object</var> is <a for=Body>unusable</a>, then return <a>a promise rejected with</a>
 a {{TypeError}}.

 <li><p>Let <var>promise</var> be <a>a new promise</a>.

 <li>Let <var>errorSteps</var> given <var>error</var> be to <a>reject</a> <var>promise</var> with
 <var>error</var>.

 <li>Let <var>successSteps</var> given a <a for=/>byte sequence</a> <var>data</var> be to
 <a for=/>resolve</a> <var>promise</var> with the result of running <var>convertBytesToJSValue</var>
 with <var>data</var>. If that threw an exception, then run <var>errorSteps</var> with that
 exception.

 <li><p>If <var>object</var>'s <a for=Body>body</a> is null, then run <var>successSteps</var>
 with an empty <a for=/>byte sequence</a>.

 <li><p>Otherwise, <a for=body>fully read</a> <var>object</var>'s <a for=Body>body</a> given
 <var>successSteps</var>, <var>errorSteps</var>, and <var>object</var>'s
 <a>relevant global object</a>.

 <li><p>Return <var>promise</var>.
</ol>
</div>

<div algorithm>
<p>The <dfn method for=Body><code>arrayBuffer()</code></dfn> method steps are to return the result
of running <a for=Body>consume body</a> with <a>this</a> and the following step given a
<a for=/>byte sequence</a> <var>bytes</var>: return a new {{ArrayBuffer}} whose contents are
<var>bytes</var>.

<p class="note">The above method can reject with a {{RangeError}}.
</div>

<div algorithm>
<p>The <dfn method for=Body><code>blob()</code></dfn> method steps are to return the result
of running <a for=Body>consume body</a> with <a>this</a> and the following step given a
<a for=/>byte sequence</a> <var>bytes</var>: return a {{Blob}} whose contents are <var>bytes</var>
and whose {{Blob/type}} attribute is <a>this</a>'s <a for=Body>MIME type</a>.
</div>

<div algorithm>
<p>The <dfn method for=Body><code>formData()</code></dfn> method steps are to return the result of
running <a for=Body>consume body</a> with <a>this</a> and the following step given a
<a for=/>byte sequence</a> <var>bytes</var>: switch on <a>this</a>'s <a for=Body>MIME type</a>'s
<a for="MIME type">essence</a> and run the corresponding steps:

<dl class=switch>
 <dt>"<code>multipart/form-data</code>",
 <dd>
  <ol>
   <li>
    <p>Parse <var>bytes</var>, using the value of the `<code>boundary</code>` parameter from
    <a>this</a>'s <a for=Body>MIME type</a>, per the rules set forth in
    <cite>Returning Values from Forms: multipart/form-data</cite>. [[!RFC7578]]</p>

    <p>Each part whose `<code>Content-Disposition</code>` header contains a `<code>filename</code>`
    parameter must be parsed into an <a for="entry list">entry</a> whose value is a {{File}} object
    whose contents are the contents of the part. The {{File/name}} attribute of the {{File}} object
    must have the value of the `<code>filename</code>` parameter of the part. The {{Blob/type}}
    attribute of the {{File}} object must have the value of the `<code>Content-Type</code>` header
    of the part if the part has such header, and `<code>text/plain</code>` (the default defined by
    [[!RFC7578]] section 4.4) otherwise.</p>

    <p>Each part whose `<code>Content-Disposition</code>` header does not contain a
    `<code>filename</code>` parameter must be parsed into an <a for="entry list">entry</a> whose
    value is the <a lt="UTF-8 decode without BOM">UTF-8 decoded without BOM</a> content of the part.
    <span class=note>This is done regardless of the presence or the value of a
    `<code>Content-Type</code>` header and regardless of the presence or the value of a
    `<code>charset</code>` parameter.</span></p>

    <p class=note>A part whose `<code>Content-Disposition</code>` header contains a
    `<code>name</code>` parameter whose value is `<code>_charset_</code>` is parsed like any other
    part. It does not change the encoding.</p>
   </li>

   <li><p>If that fails for some reason, then <a>throw</a> a {{TypeError}}.

   <li><p>Return a new {{FormData}} object, appending each <a for="entry list">entry</a>, resulting
   from the parsing operation, to its <a for=FormData>entry list</a>.
  </ol>

  <p class=XXX>The above is a rough approximation of what is needed for
  `<code>multipart/form-data</code>`, a more detailed parsing specification is to be
  written. Volunteers welcome.

 <dt>"<code>application/x-www-form-urlencoded</code>",
 <dd>
  <ol>
   <li><p>Let <var>entries</var> be the result of  <a lt="urlencoded parser">parsing</a>
   <var>bytes</var>.

   <li><p>If <var>entries</var> is failure, then <a>throw</a> a {{TypeError}}.

   <li><p>Return a new {{FormData}} object whose <a for=FormData>entry list</a> is
   <var>entries</var>.
  </ol>

 <dt>Otherwise
 <dd><p><a>Throw</a> a {{TypeError}}.
</dl>
</div>

<div algorithm>
<p>The <dfn method for=Body><code>json()</code></dfn> method steps are to return the result
of running <a for=Body>consume body</a> with <a>this</a> and <a>parse JSON from bytes</a>.

<p class="note">The above method can reject with a {{SyntaxError}}.
</div>

<div algorithm>
<p>The <dfn method for=Body><code>text()</code></dfn> method steps are to return the result
of running <a for=Body>consume body</a> with <a>this</a> and <a>UTF-8 decode</a>.
</div>


<h3 id=request-class>Request class</h3>

<!-- No client member, see
  https://github.com/w3c/ServiceWorker/issues/318
  https://github.com/w3c/ServiceWorker/issues/575 -->

<pre class=idl>
typedef (Request or USVString) RequestInfo;

[Exposed=(Window,Worker)]
interface Request {
  constructor(RequestInfo input, optional RequestInit init = {});

  readonly attribute ByteString method;
  readonly attribute USVString url;
  [SameObject] readonly attribute Headers headers;

  readonly attribute RequestDestination destination;
  readonly attribute USVString referrer;
  readonly attribute ReferrerPolicy referrerPolicy;
  readonly attribute RequestMode mode;
  readonly attribute RequestCredentials credentials;
  readonly attribute RequestCache cache;
  readonly attribute RequestRedirect redirect;
  readonly attribute DOMString integrity;
  readonly attribute boolean keepalive;
  readonly attribute boolean isReloadNavigation;
  readonly attribute boolean isHistoryNavigation;
  readonly attribute AbortSignal signal;
  readonly attribute RequestDuplex duplex;

  [NewObject] Request clone();
};
Request includes Body;

dictionary RequestInit {
  ByteString method;
  HeadersInit headers;
  BodyInit? body;
  USVString referrer;
  ReferrerPolicy referrerPolicy;
  RequestMode mode;
  RequestCredentials credentials;
  RequestCache cache;
  RequestRedirect redirect;
  DOMString integrity;
  boolean keepalive;
  AbortSignal? signal;
  RequestDuplex duplex;
  RequestPriority priority;
  any window; // can only be set to null
};

enum RequestDestination { "", "audio", "audioworklet", "document", "embed", "font", "frame", "iframe", "image", "manifest", "object", "paintworklet", "report", "script", "sharedworker", "style",  "track", "video", "worker", "xslt" };
enum RequestMode { "navigate", "same-origin", "no-cors", "cors" };
enum RequestCredentials { "omit", "same-origin", "include" };
enum RequestCache { "default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached" };
enum RequestRedirect { "follow", "error", "manual" };
enum RequestDuplex { "half" };
enum RequestPriority { "high", "low", "auto" };
</pre>

<p class=note>"<code>serviceworker</code>" is omitted from
<a enum><code>RequestDestination</code></a> as it cannot be observed from JavaScript. Implementations
will still need to support it as a <a for=request>destination</a>. "<code>websocket</code>" is
omitted from <a enum><code>RequestMode</code></a> as it cannot be used nor observed from JavaScript.

<p>A {{Request}} object has an associated
<dfn id=concept-request-request for=Request export>request</dfn> (a <a for=/>request</a>).

<p>A {{Request}} object also has an associated <dfn for=Request export>headers</dfn> (null or a
{{Headers}} object), initially null.

<p>A {{Request}} object has an associated <dfn for=Request>signal</dfn> (null or an {{AbortSignal}}
object), initially null.

<p>A {{Request}} object's <a for=Body>MIME type</a> is to return the result of
<a for="header list">extracting a MIME type</a> from its <a for=Request>request</a>'s
<a for=request>header list</a>.

<p>A {{Request}} object's <a for=Body>body</a> is its
<a for=Request>request</a>'s
<a for=request>body</a>.

<hr>

<dl class=domintro>
 <dt><code><var>request</var> = new <a constructor lt="Request()">Request</a>(<var>input</var> [,
 <var>init</var>])</code>
 <dd>
  <p>Returns a new <var>request</var> whose {{Request/url}} property is <var>input</var> if
  <var>input</var> is a string, and <var>input</var>'s {{Request/url}} if <var>input</var> is a
  {{Request}} object.

  <p>The <var>init</var> argument is an object whose properties can be set as follows:</p>

  <dl>
   <dt>{{RequestInit/method}}
   <dd>A string to set <var>request</var>'s {{Request/method}}.

   <dt>{{RequestInit/headers}}
   <dd>A {{Headers}} object, an object literal, or an array of two-item arrays to set
   <var>request</var>'s {{Request/headers}}.

   <dt>{{RequestInit/body}}
   <dd>A {{BodyInit}} object or null to set <var>request</var>'s <a for=request>body</a>.

   <dt>{{RequestInit/referrer}}
   <dd>A string whose value is a same-origin URL, "<code>about:client</code>", or the empty string,
   to set <var>request</var>'s <a>referrer</a>.

   <dt>{{RequestInit/referrerPolicy}}
   <dd>A <a for=/>referrer policy</a> to set <var>request</var>'s {{Request/referrerPolicy}}.

   <dt>{{RequestInit/mode}}
   <dd>A string to indicate whether the request will use CORS, or will be restricted to same-origin
   URLs. Sets <var>request</var>'s {{Request/mode}}. If <var>input</var> is a string, it defaults to
   "<code>cors</code>".

   <dt>{{RequestInit/credentials}}
   <dd>A string indicating whether credentials will be sent with the request always, never, or only
   when sent to a same-origin URL — as well as whether any credentials sent back in the response
   will be used always, never, or only when received from a same-origin URL. Sets
   <var>request</var>'s {{Request/credentials}}. If <var>input</var> is a string, it defaults to
   "<code>same-origin</code>".

   <dt>{{RequestInit/cache}}
   <dd>A string indicating how the request will interact with the browser's cache to set
   <var>request</var>'s {{Request/cache}}.

   <dt>{{RequestInit/redirect}}
   <dd>A string indicating whether <var>request</var> follows redirects, results in an error upon
   encountering a redirect, or returns the redirect (in an opaque fashion). Sets
   <var>request</var>'s {{Request/redirect}}.

   <dt>{{RequestInit/integrity}}
   <dd>A cryptographic hash of the resource to be fetched by <var>request</var>. Sets
   <var>request</var>'s {{Request/integrity}}.

   <dt>{{RequestInit/keepalive}}
   <dd>A boolean to set <var>request</var>'s {{Request/keepalive}}.

   <dt>{{RequestInit/signal}}
   <dd>An {{AbortSignal}} to set <var>request</var>'s {{Request/signal}}.

   <dt>{{RequestInit/window}}
   <dd>Can only be null. Used to disassociate <var>request</var> from any {{Window}}.

   <dt>{{RequestInit/duplex}}
   <dd>"<code>half</code>" is the only valid value and it is for initiating a half-duplex fetch
   (i.e., the user agent sends the entire request before processing the response).
   "<code>full</code>" is reserved for future use, for initiating a full-duplex fetch (i.e., the
   user agent can process the response before sending the entire request). This member needs to be
   set when {{RequestInit/body}} is a {{ReadableStream}} object. <span class=note>See
   <a href="https://github.com/whatwg/fetch/issues/1254">issue #1254</a> for defining
   "<code>full</code>".</span>

   <dt>{{RequestInit/priority}}
   <dd>A string to set <var>request</var>'s <a for=request>priority</a>.
  </dl>

 <dt><code><var>request</var> . <a attribute for=Request>method</a></code>
 <dd>Returns <var>request</var>'s HTTP method, which is "<code>GET</code>" by default.

 <dt><code><var>request</var> . <a attribute for=Request>url</a></code>
 <dd>Returns the URL of <var>request</var> as a string.

 <dt><code><var>request</var> . <a attribute for=Request>headers</a></code>
 <dd>Returns a {{Headers}} object consisting of the headers associated with <var>request</var>.
 Note that headers added in the network layer by the user agent will not be accounted for in this
 object, e.g., the "<code>Host</code>" header.

 <dt><code><var>request</var> . <a attribute for=Request>destination</a></code>
 <dd>Returns the kind of resource requested by <var>request</var>, e.g., "<code>document</code>" or
 "<code>script</code>".

 <dt><code><var>request</var> . <a attribute for=Request>referrer</a></code>
 <dd>Returns the referrer of <var>request</var>. Its value can be a same-origin URL if
 explicitly set in <var>init</var>, the empty string to indicate no referrer, and
 "<code>about:client</code>" when defaulting to the global's default. This is used during
 fetching to determine the value of the `<code>Referer</code>` header of the request being made.

 <dt><code><var>request</var> . <a attribute for=Request>referrerPolicy</a></code>
 <dd>Returns the referrer policy associated with <var>request</var>. This is used during
 fetching to compute the value of the <var>request</var>'s referrer.

 <dt><code><var>request</var> . <a attribute for=Request>mode</a></code>
 <dd>Returns the <a>mode</a> associated with <var>request</var>, which is a string indicating
 whether the request will use CORS, or will be restricted to same-origin URLs.

 <dt><code><var>request</var> . <a attribute for=Request>credentials</a></code>
 <dd>Returns the <a>credentials mode</a> associated with <var>request</var>, which is a string
 indicating whether credentials will be sent with the request always, never, or only when sent to a
 same-origin URL.

 <dt><code><var>request</var> . <a attribute for=Request>cache</a></code>
 <dd>Returns the <a>cache mode</a> associated with <var>request</var>, which is a string indicating
 how the request will interact with the browser's cache when fetching.

 <dt><code><var>request</var> . <a attribute for=Request>redirect</a></code>
 <dd>Returns the <a>redirect mode</a> associated with <var>request</var>, which is a string
 indicating how redirects for the request will be handled during fetching. A <a for=/>request</a>
 will follow redirects by default.

 <dt><code><var>request</var> . <a attribute for=Request>integrity</a></code>
 <dd>Returns <var>request</var>'s subresource integrity metadata, which is a cryptographic hash of
 the resource being fetched. Its value consists of multiple hashes separated by whitespace. [[SRI]]

 <dt><code><var>request</var> . <a attribute for=Request>keepalive</a></code>
 <dd>Returns a boolean indicating whether or not <var>request</var> can outlive the global in which
 it was created.

 <dt><code><var>request</var> . <a attribute for=Request>isReloadNavigation</a></code>
 <dd>Returns a boolean indicating whether or not <var>request</var> is for a reload navigation.

 <dt><code><var>request</var> . <a attribute for=Request>isHistoryNavigation</a></code>
 <dd>Returns a boolean indicating whether or not <var>request</var> is for a history
 navigation (a.k.a. back-foward navigation).

 <dt><code><var>request</var> . <a attribute for=Request>signal</a></code>
 <dd>Returns the signal associated with <var>request</var>, which is an
 {{AbortSignal}} object indicating whether or not <var>request</var> has been aborted, and its abort
 event handler.

 <dt><code><var>request</var> . <a attribute for=Request>duplex</a></code>
 <dd>Returns "<code>half</code>", meaning the fetch will be half-duplex (i.e., the user agent sends
 the entire request before processing the response). In future, it could also return
 "<code>full</code>", meaning the fetch will be full-duplex (i.e., the user agent can process the
 response before sending the entire request) to indicate that the fetch will be full-duplex.
 <span class=note>See <a href="https://github.com/whatwg/fetch/issues/1254">issue #1254</a> for
 defining "<code>full</code>".</span>

 <dt><code><var>request</var> . <a method for=Request>clone</a>()</code>
 <dd><p>Returns a clone of <var>request</var>.
</dl>

<hr>

<div algorithm>
<p>To <dfn export for=Request lt=create|creating>create</dfn> a {{Request}} object, given a
<a for=/>request</a> <var>request</var>, <a for=/>headers guard</a> <var>guard</var>, and
<a>realm</a> <var>realm</var>, run these steps:

<ol>
 <li><p>Let <var>requestObject</var> be a <a for=/>new</a> {{Request}} object with <var>realm</var>.

 <li><p>Set <var>requestObject</var>'s <a for=Request>request</a> to <var>request</var>.

 <li><p>Set <var>requestObject</var>'s <a for=Request>headers</a> to a <a for=/>new</a> {{Headers}}
 object with <var>realm</var>, whose <a for=Headers>headers list</a> is <var>request</var>'s
 <a for=request>headers list</a> and <a for=Headers>guard</a> is <var>guard</var>.

 <li><p>Set <var>requestObject</var>'s <a for=Request>signal</a> to a <a for=/>new</a>
 {{AbortSignal}} object with <var>realm</var>.

 <li><p>Return <var>requestObject</var>.
</ol>
</div>

<hr>

<div algorithm>
<p>The
<dfn constructor for=Request id=dom-request lt="Request(input, init)"><code>new Request(<var>input</var>, <var>init</var>)</code></dfn>
constructor steps are:

<ol>
 <li><p>Let <var>request</var> be null.

 <li><p>Let <var>fallbackMode</var> be null.

 <li><p>Let <var>baseURL</var> be <a>this</a>'s <a>relevant settings object</a>'s
 <a for="environment settings object">API base URL</a>.

 <li><p>Let <var>signal</var> be null.

 <li>
  <p>If <var>input</var> is a string, then:

  <ol>
   <li><p>Let <var>parsedURL</var> be the result of
   <a lt="url parser">parsing</a> <var>input</var> with
   <var>baseURL</var>.

   <li><p>If <var>parsedURL</var> is failure, then <a>throw</a> a {{TypeError}}.

   <li><p>If <var>parsedURL</var> <a lt="include credential">includes credentials</a>, then
   <a>throw</a> a {{TypeError}}.

   <li><p>Set <var>request</var> to a new <a for=/>request</a> whose <a for=request>URL</a> is
   <var>parsedURL</var>.

   <li><p>Set <var>fallbackMode</var> to "<code>cors</code>".
  </ol>

 <li>
  <p>Otherwise:

  <ol>
   <li><p>Assert: <var>input</var> is a {{Request}} object.

   <li><p>Set <var>request</var> to <var>input</var>'s
   <a for=Request>request</a>.

   <li><p>Set <var>signal</var> to <var>input</var>'s <a for=Request>signal</a>.
  </ol>

 <li><p>Let <var>origin</var> be <a>this</a>'s <a>relevant settings object</a>'s
 <a for="environment settings object">origin</a>.

 <li><p>Let <var>window</var> be "<code>client</code>".

 <li><p>If <var>request</var>'s <a for=request>window</a> is
 an <a>environment settings object</a> and its
 <a for="environment settings object">origin</a> is <a>same origin</a> with
 <var>origin</var>, then set <var>window</var> to <var>request</var>'s
 <a for=request>window</a>.

 <li><p>If <var>init</var>["{{RequestInit/window}}"] <a for=map>exists</a> and is non-null, then
 <a>throw</a> a {{TypeError}}.

 <li><p>If <var>init</var>["{{RequestInit/window}}"] <a for=map>exists</a>, then set
 <var>window</var> to "<code>no-window</code>".

 <li>
  <p>Set <var>request</var> to a new <a for=/>request</a> with the following properties:

  <dl>
   <dt><a for=request>URL</a>
   <dd><var>request</var>'s <a for=request>URL</a>.

   <dt><a for=request>method</a>
   <dd><var>request</var>'s <a for=request>method</a>.

   <dt><a for=request>header list</a>
   <dd>A copy of <var>request</var>'s <a for=request>header list</a>.

   <dt><a>unsafe-request flag</a>
   <dd>Set.

   <dt><a for=request>client</a>
   <dd><a>This</a>'s <a>relevant settings object</a>.

   <dt><a for=request>window</a>
   <dd><var>window</var>.

   <dt><a for=request>internal priority</a>
   <dd><var>request</var>'s <a for=request>internal priority</a>.

   <dt><a for=request>origin</a>
   <dd><var>request</var>'s <a for=request>origin</a>. <span class=note>The propagation of the
   <a for=/>origin</a> is only significant for navigation requests being handled by a service
   worker. In this scenario a request can have an origin that is different from the current
   client.</span>

   <dt><a for=request>referrer</a>
   <dd><var>request</var>'s <a for=request>referrer</a>.

   <dt><a for=request>referrer policy</a>
   <dd><var>request</var>'s <a for=request>referrer policy</a>.

   <dt><a for=request>mode</a>
   <dd><var>request</var>'s <a for=request>mode</a>.

   <dt><a for=request>credentials mode</a>
   <dd><var>request</var>'s <a for=request>credentials mode</a>.

   <dt><a for=request>cache mode</a>
   <dd><var>request</var>'s <a for=request>cache mode</a>.

   <dt><a for=request>redirect mode</a>
   <dd><var>request</var>'s <a for=request>redirect mode</a>.

   <dt><a for=request>integrity metadata</a>
   <dd><var>request</var>'s <a for=request>integrity metadata</a>.

   <dt><a for=request>keepalive</a>
   <dd><var>request</var>'s <a for=request>keepalive</a>.

   <dt><a for=request>reload-navigation flag</a>
   <dd><var>request</var>'s <a for=request>reload-navigation flag</a>.

   <dt><a for=request>history-navigation flag</a>
   <dd><var>request</var>'s <a for=request>history-navigation flag</a>.

   <dt><a for=request>URL list</a>
   <dd>A <a for=list>clone</a> of <var>request</var>'s <a for=request>URL list</a>.

   <dt><a for=request>initiator type</a>
   <dd>"<code>fetch</code>".
  </dl>

 <li>
  <p>If <var>init</var> <a for=map>is not empty</a>, then:

  <ol>
   <li><p>If <var>request</var>'s <a for=request>mode</a> is
   "<code>navigate</code>", then set it to "<code>same-origin</code>".
   <!-- This works because we have reset request's client too. -->

   <li><p>Unset <var>request</var>'s <a for=request>reload-navigation flag</a>.

   <li><p>Unset <var>request</var>'s <a for=request>history-navigation flag</a>.

   <li><p>Set <var>request</var>'s <a for=request>origin</a> to "<code>client</code>".

   <li><p>Set <var>request</var>'s <a for=request>referrer</a> to "<code>client</code>".

   <li><p>Set <var>request</var>'s <a for=request>referrer policy</a> to the empty string.

   <li><p>Set <var>request</var>'s <a for=request>URL</a> to <var>request</var>'s
   <a for=request>current URL</a>.

   <li><p>Set <var>request</var>'s <a for=request>URL list</a> to « <var>request</var>'s
   <a for=request>URL</a> ».
  </ol>

  <p class=note>This is done to ensure that when a service worker "redirects" a request, e.g., from
  an image in a cross-origin style sheet, and makes modifications, it no longer appears to come from
  the original source (i.e., the cross-origin style sheet), but instead from the service worker that
  "redirected" the request. This is important as the original source might not even be able to
  generate the same kind of requests as the service worker. Services that trust the original source
  could therefore be exploited were this not done, although that is somewhat farfetched.

 <li>
  <p>If <var>init</var>["{{RequestInit/referrer}}"] <a for=map>exists</a>, then:

  <ol>
   <li><p>Let <var>referrer</var> be <var>init</var>["{{RequestInit/referrer}}"].

   <li><p>If <var>referrer</var> is the empty string, then set <var>request</var>'s
   <a for=request>referrer</a> to "<code>no-referrer</code>".

   <li>
    <p>Otherwise:

    <ol>
     <li><p>Let <var>parsedReferrer</var> be the result of <a lt="URL parser">parsing</a>
     <var>referrer</var> with <var>baseURL</var>.

     <li><p>If <var>parsedReferrer</var> is failure, then <a>throw</a> a {{TypeError}}.

     <li>
      <p>If one of the following is true

      <ul class=brief>
       <li><p><var>parsedReferrer</var>'s <a for=url>scheme</a> is "<code>about</code>" and
       <a for=url>path</a> is the string "<code>client</code>"

       <li><p><var>parsedReferrer</var>'s <a for=url>origin</a> is not <a>same origin</a> with
       <var>origin</var>
      </ul>

      <p>then set <var>request</var>'s <a for=request>referrer</a> to "<code>client</code>".
      <!-- This can happen when you create a fresh request with values from an older request.
           Throwing would be rather hostile as preventing it requires implementing the same-origin
           check in developer space. -->

     <li><p>Otherwise, set <var>request</var>'s <a for=request>referrer</a> to
     <var>parsedReferrer</var>.
    </ol>
  </ol>

 <li><p>If <var>init</var>["{{RequestInit/referrerPolicy}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>referrer policy</a> to it.

 <li><p>Let <var>mode</var> be <var>init</var>["{{RequestInit/mode}}"] if it <a for=map>exists</a>,
 and <var>fallbackMode</var> otherwise.

 <li><p>If <var>mode</var> is "<code>navigate</code>", then <a>throw</a> a {{TypeError}}.

 <li><p>If <var>mode</var> is non-null, set <var>request</var>'s
 <a for=request>mode</a> to <var>mode</var>.

 <li><p>If <var>init</var>["{{RequestInit/credentials}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>credentials mode</a> to it.

 <li><p>If <var>init</var>["{{RequestInit/cache}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>cache mode</a> to it.

 <li><p>If <var>request</var>'s <a for=request>cache mode</a> is "<code>only-if-cached</code>" and
 <var>request</var>'s <a for=request>mode</a> is <em>not</em> "<code>same-origin</code>", then
 <a>throw</a> a {{TypeError}}.

 <li><p>If <var>init</var>["{{RequestInit/redirect}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>redirect mode</a> to it.

 <li><p>If <var>init</var>["{{RequestInit/integrity}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>integrity metadata</a> to it.

 <li><p>If <var>init</var>["{{RequestInit/keepalive}}"] <a for=map>exists</a>, then set
 <var>request</var>'s <a for=request>keepalive</a> to it.

 <li>
  <p>If <var>init</var>["{{RequestInit/method}}"] <a for=map>exists</a>, then:

  <ol>
   <li><p>Let <var>method</var> be <var>init</var>["{{RequestInit/method}}"].

   <li><p>If <var>method</var> is not a <a for=/>method</a> or <var>method</var> is a
   <a>forbidden method</a>, then <a>throw</a> a {{TypeError}}.

   <li><p><a lt=normalize for=method>Normalize</a> <var>method</var>.

   <li><p>Set <var>request</var>'s <a for=request>method</a> to <var>method</var>.
  </ol>

 <li><p>If <var>init</var>["{{RequestInit/signal}}"] <a for=map>exists</a>, then set
 <var>signal</var> to it.

 <li>
  <p>If <var>init</var>["{{RequestInit/priority}}"] <a for=map>exists</a>, then:

  <ol>
   <li><p>If <var>request</var>'s <a for=request>internal priority</a> is not null, then update
   <var>request</var>'s <a for=request>internal priority</a> in an <a>implementation-defined</a>
   manner.

   <li><p>Otherwise, set <var>request</var>'s <a for=request>priority</a> to
   <var>init</var>["{{RequestInit/priority}}"].
  </ol>

 <li><p>Set <a>this</a>'s <a for=Request>request</a> to <var>request</var>.

 <li><p>Set <a>this</a>'s <a for=Request>signal</a> to a <a for=/>new</a> {{AbortSignal}} object
 with <a>this</a>'s <a>relevant Realm</a>.

 <li><p>If <var>signal</var> is non-null, then make <a>this</a>'s <a for=Request>signal</a>
 <a for=AbortSignal>follow</a> <var>signal</var>.

 <li><p>Set <a>this</a>'s <a for=Request>headers</a> to a <a for=/>new</a> {{Headers}} object with
 <a>this</a>'s <a>relevant Realm</a>, whose <a for=Headers>header list</a> is <var>request</var>'s
 <a for=request>header list</a> and <a for=Headers>guard</a> is "<code>request</code>".

 <li>
  <p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>mode</a> is
  "<code>no-cors</code>", then:

  <ol>
   <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>method</a> is not a
   <a>CORS-safelisted method</a>, then <a>throw</a> a {{TypeError}}.
   <!-- This will throw in cases where APIs have created no-cors requests with a non-safe method and
   the developer has called new Request(fetchEvent.request) or fetch(fetchEvent.request) within a
   service worker fetch event. This shouldn't happen, as APIs shouldn't create no-cors requests with
   a non-safe method -->

   <li><p>Set <a>this</a>'s <a for=Request>headers</a>'s <a for=Headers>guard</a> to
   "<code>request-no-cors</code>".
  </ol>
 </li>

 <li>
  <p>If <var>init</var> <a for=map>is not empty</a>, then:

  <p class=note>The headers are sanitized as they might contain headers that are not allowed by this
  mode. Otherwise, they were previously sanitized or are unmodified since they were set by a
  privileged API.

  <ol>
   <li><p>Let <var>headers</var> be a copy of <a>this</a>'s <a for=Request>headers</a> and its
   associated <a for=Headers>header list</a>.

   <li><p>If <var>init</var>["{{RequestInit/headers}}"] <a for=map>exists</a>, then set
   <var>headers</var> to <var>init</var>["{{RequestInit/headers}}"].

   <li><p>Empty <a>this</a>'s <a for=Request>headers</a>'s <a for=Headers>header list</a>.

   <li><p>If <var>headers</var> is a {{Headers}} object, then <a for=list>for each</a>
   <var>header</var> of its <a for=Headers>header list</a>, <a for=Headers>append</a>
   <var>header</var> to <a>this</a>'s <a for=Request>headers</a>.

   <li><p>Otherwise, <a for=Headers>fill</a> <a>this</a>'s <a for=Request>headers</a> with
   <var>headers</var>.
  </ol>
 </li>

 <li><p>Let <var>inputBody</var> be <var>input</var>'s <a for=Request>request</a>'s
 <a for=request>body</a> if <var>input</var> is a {{Request}} object; otherwise null.

 <li><p>If either <var>init</var>["{{RequestInit/body}}"] <a for=map>exists</a> and is non-null or
 <var>inputBody</var> is non-null, and <var>request</var>'s <a for=request>method</a> is
 `<code>GET</code>` or `<code>HEAD</code>`, then <a>throw</a> a {{TypeError}}.

 <li><p>Let <var>initBody</var> be null.

 <li>
  <p>If <var>init</var>["{{RequestInit/body}}"] <a for=map>exists</a> and is non-null, then:

  <ol>
   <li><p>Let <var>bodyWithType</var> be the result of <a for=BodyInit>extracting</a>
   <var>init</var>["{{RequestInit/body}}"], with <a for=BodyInit/extract><i>keepalive</i></a>
   set to <var>request</var>'s <a for=request>keepalive</a>.

   <li><p>Set <var>initBody</var> to <var>bodyWithType</var>'s <a for="body with type">body</a>.

   <li><p>Let <var>type</var> be <var>bodyWithType</var>'s <a for="body with type">type</a>.

   <li><p>If <var>type</var> is non-null and <a>this</a>'s <a for=Request>headers</a>'s
   <a for=Headers>header list</a> <a for="header list">does not contain</a>
   `<code>Content-Type</code>`, then <a for=Headers>append</a> (`<code>Content-Type</code>`,
   <var>type</var>) to <a>this</a>'s <a for=Request>headers</a>.
  </ol>

 <li><p>Let <var>inputOrInitBody</var> be <var>initBody</var> if it is non-null; otherwise
 <var>inputBody</var>.

 <li>
  <p>If <var>inputOrInitBody</var> is non-null and <var>inputOrInitBody</var>'s
  <a for=body>source</a> is null, then:

  <ol>
   <li><p>If <var>initBody</var> is non-null and <var>init</var>["{{RequestInit/duplex}}"] does
   not <a for=map>exist</a>, then throw a {{TypeError}}.

   <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>mode</a> is neither
   "<code>same-origin</code>" nor "<code>cors</code>", then throw a {{TypeError}}.

   <li><p>Set <a>this</a>'s <a for=Request>request</a>'s
   <a for=request>use-CORS-preflight flag</a>.
  </ol>

 <li><p>Let <var>finalBody</var> be <var>inputOrInitBody</var>.

 <li>
  <p>If <var>initBody</var> is null and <var>inputBody</var> is non-null, then:

  <ol>
   <li><p>If <var>input</var> is <a for=Body>unusable</a>, then <a>throw</a> a {{TypeError}}.

   <!-- Any steps after this must not throw. -->

   <li><p>Set <var>finalBody</var> to the result of <a for=ReadableStream>creating a proxy</a> for
   <var>inputBody</var>.
  </ol>

 <li><p>Set <a>this</a>'s <a for=Request>request</a>'s <a for=request>body</a> to
 <var>finalBody</var>.
</ol>
</div>

<p>The <dfn attribute for=Request><code>method</code></dfn> getter steps are to return <a>this</a>'s
<a for=Request>request</a>'s <a for=request>method</a>.

<p>The <dfn attribute for=Request><code>url</code></dfn> getter steps are to return <a>this</a>'s
<a for=Request>request</a>'s <a for=request>URL</a>, <a lt="URL serializer">serialized</a>.

<p>The <dfn attribute for=Request><code>headers</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>headers</a>.

<p>The <dfn attribute for=Request><code>destination</code></dfn> getter are to return <a>this</a>'s
<a for=Request>request</a>'s <a for=request>destination</a>.

<div algorithm>
<p>The <dfn attribute for=Request><code>referrer</code></dfn> getter steps are:

<ol>
 <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>referrer</a> is
 "<code>no-referrer</code>", then return the empty string.

 <li><p>If <a>this</a>'s <a for=Request>request</a>'s <a for=request>referrer</a> is
 "<code>client</code>", then return "<code>about:client</code>".

 <li><p>Return <a>this</a>'s <a for=Request>request</a>'s <a for=request>referrer</a>,
 <a lt="URL serializer">serialized</a>.
</ol>
</div>

<p>The <dfn attribute for=Request><code>referrerPolicy</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>request</a>'s <a for=request>referrer policy</a>.

<p>The <dfn attribute for=Request><code>mode</code></dfn> getter steps are to return <a>this</a>'s
<a for=Request>request</a>'s <a for=request>mode</a>.

<p>The <dfn attribute for=Request><code>credentials</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>request</a>'s <a for=request>credentials mode</a>.

<p>The <dfn attribute for=Request><code>cache</code></dfn> getter steps are to return <a>this</a>'s
<a for=Request>request</a>'s <a for=request>cache mode</a>.

<p>The <dfn attribute for=Request><code>redirect</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>request</a>'s <a for=request>redirect mode</a>.

<p>The <dfn attribute for=Request><code>integrity</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>request</a>'s <a for=request>integrity metadata</a>.

<p>The <dfn attribute for=Request><code>keepalive</code></dfn> getter steps are to return
<a>this</a>'s <a for=Request>request</a>'s <a for=request>keepalive</a>.

<p>The <dfn attribute for=Request><code>isReloadNavigation</code></dfn> getter steps are to return
true if <a>this</a>'s <a for=Request>request</a>'s <a for=request>reload-navigation flag</a> is set;
otherwise false.

<p>The <dfn attribute for=Request><code>isHistoryNavigation</code></dfn> getter steps are to return
true if <a>this</a>'s <a for=Request>request</a>'s <a for=request>history-navigation flag</a> is
set; otherwise false.

<p>The <dfn attribute for=Request><code>signal</code></dfn> getter steps are to return <a>this</a>'s
<a for="Request">signal</a>.

<p>The <dfn attribute for=Request><code>duplex</code></dfn> getter steps are to return
"<code>half</code>".

<hr>

<div algorithm>
<p>The <dfn method for=Request><code>clone()</code></dfn> method steps are:

<ol>
 <li><p>If <a>this</a> is <a for=Body>unusable</a>, then <a>throw</a> a {{TypeError}}.

 <li><p>Let <var>clonedRequest</var> be the result of <a lt=clone for=request>cloning</a>
 <a>this</a>'s <a for=Request>request</a>.

 <li><p>Let <var>clonedRequestObject</var> be the result of <a for=Request>creating</a> a
 {{Request}} object, given <var>clonedRequest</var>, <a>this</a>'s
 <a for=Request>headers</a>'s <a for=Headers>guard</a>, and <a>this</a>'s <a>relevant Realm</a>.

 <li><p>Make <var>clonedRequestObject</var>'s <a for=Request>signal</a>
 <a for=AbortSignal>follow</a> <a>this</a>'s <a for=Request>signal</a>.

 <li><p>Return <var>clonedRequestObject</var>.
</ol>
</div>


<h3 id=response-class>Response class</h3>

<pre class=idl>[Exposed=(Window,Worker)]
interface Response {
  constructor(optional BodyInit? body = null, optional ResponseInit init = {});

  [NewObject] static Response error();
  [NewObject] static Response redirect(USVString url, optional unsigned short status = 302);
  [NewObject] static Response json(any data, optional ResponseInit init = {});

  readonly attribute ResponseType type;

  readonly attribute USVString url;
  readonly attribute boolean redirected;
  readonly attribute unsigned short status;
  readonly attribute boolean ok;
  readonly attribute ByteString statusText;
  [SameObject] readonly attribute Headers headers;

  [NewObject] Response clone();
};
Response includes Body;

dictionary ResponseInit {
  unsigned short status = 200;
  ByteString statusText = "";
  HeadersInit headers;
};

enum ResponseType { "basic", "cors", "default", "error", "opaque", "opaqueredirect" };
</pre>

<p>A {{Response}} object has an associated
<dfn id=concept-response-response for=Response export>response</dfn> (a
<a for=/>response</a>).

<p>A {{Response}} object also has an associated <dfn for=Response export>headers</dfn> (null or a
{{Headers}} object), initially null.

<p>A {{Response}} object's <a for=Body>MIME type</a> is to return the result of
<a for="header list">extracting a MIME type</a> from its <a for=Response>response</a>'s
<a for=response>header list</a>.

<p>A {{Response}} object's <a for=Body>body</a> is its
<a for=Response>response</a>'s <a for=response>body</a>.

<hr>

<dl class=domintro>
 <dt><code><var>response</var> = new <a constructor lt="Response(body, init)">Response</a>(<var>body</var> = null [, <var>init</var>])</code>
 <dd><p>Creates a {{Response}} whose body is <var>body</var>, and status, status message, and
 headers are provided by <var>init</var>.

 <dt><code><var>response</var> = <a idl>Response</a> . <a method for=Response lt=error()>error</a>()</code>
 <dd><p>Creates network error {{Response}}.

 <dt><code><var>response</var> = <a idl>Response</a> . <a method for=Response lt=redirect()>redirect</a>(<var>url</var>, <var>status</var> = 302)</code>
 <dd><p>Creates a redirect {{Response}} that redirects to <var>url</var> with status
 <var>status</var>.

 <dt><code><var>response</var> = <a idl>Response</a> . <a method for=Response lt=json()>json</a>(<var>data</var> [, <var>init</var>])</code>
 <dd><p>Creates a {{Response}} whose body is the JSON-encoded <var>data</var>, and status, status
 message, and headers are provided by <var>init</var>.

 <dt><code><var>response</var> . <a attribute for=Response>type</a></code>
 <dd><p>Returns <var>response</var>'s type, e.g., "<code>cors</code>".

 <dt><code><var>response</var> . <a attribute for=Response>url</a></code>
 <dd><p>Returns <var>response</var>'s URL, if it has one; otherwise the empty string.

 <dt><code><var>response</var> . <a attribute for=Response>redirected</a></code>
 <dd><p>Returns whether <var>response</var> was obtained through a redirect.

 <dt><code><var>response</var> . <a attribute for=Response>status</a></code>
 <dd><p>Returns <var>response</var>'s status.

 <dt><code><var>response</var> . <a attribute for=Response>ok</a></code>
 <dd><p>Returns whether <var>response</var>'s status is an <a for=/>ok status</a>.

 <dt><code><var>response</var> . <a attribute for=Response>statusText</a></code>
 <dd><p>Returns <var>response</var>'s status message.

 <dt><code><var>response</var> . <a attribute for=Response>headers</a></code>
 <dd><p>Returns <var>response</var>'s headers as {{Headers}}.

 <dt><code><var>response</var> . <a method for=Response>clone</a>()</code>
 <dd><p>Returns a clone of <var>response</var>.
</dl>

<hr>

<div algorithm>
<p>To <dfn export for=Response lt=create|creating>create</dfn> a {{Response}} object, given a
<a for=/>response</a> <var>response</var>, <a for=/>headers guard</a> <var>guard</var>, and
<a>realm</a> <var>realm</var>, run these steps:

<ol>
 <li><p>Let <var>responseObject</var> be a <a for=/>new</a> {{Response}} object with
 <var>realm</var>.

 <li><p>Set <var>responseObject</var>'s <a for=Response>response</a> to <var>response</var>.

 <li><p>Set <var>responseObject</var>'s <a for=Response>headers</a> to a <a for=/>new</a>
 {{Headers}} object with <var>realm</var>, whose <a for=Headers>headers list</a> is
 <var>response</var>'s <a for=response>headers list</a> and <a for=Headers>guard</a> is
 <var>guard</var>.

 <li><p>Return <var>responseObject</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn>initialize a response</dfn>, given a {{Response}} object <var>response</var>,
{{ResponseInit}} <var>init</var>, and an optional <a for=/>body with type</a> <var>body</var>, run
these steps:

<ol>
 <li><p>If <var>init</var>["{{ResponseInit/status}}"] is not in the range 200 to 599, inclusive,
 then <a>throw</a> a {{RangeError}}.

 <li><p>If <var>init</var>["{{ResponseInit/statusText}}"] does not match the
 <a spec=http1>reason-phrase</a> token production, then <a>throw</a> a {{TypeError}}.

 <li><p>Set <var>response</var>'s <a for=Response>response</a>'s <a for=response>status</a> to
 <var>init</var>["{{ResponseInit/status}}"].

 <li><p>Set <var>response</var>'s <a for=Response>response</a>'s <a for=response>status message</a>
 to <var>init</var>["{{ResponseInit/statusText}}"].

 <li><p>If <var>init</var>["{{ResponseInit/headers}}"] <a for=map>exists</a>, then
 <a for=Headers>fill</a> <var>response</var>'s <a for=Response>headers</a> with
 <var>init</var>["{{ResponseInit/headers}}"].

 <li>
  <p>If <var>body</var> was given, then:

  <ol>
   <li>
    <p>If <var>response</var>'s <a for=response>status</a> is a <a>null body status</a>, then
    <a>throw</a> a {{TypeError}}.

    <p class=note>101 and 103 are included in <a>null body status</a> due to their use elsewhere.
    They do not affect this step.

   <li><p>Set <var>response</var>'s <a for=response>body</a> to <var>body</var>'s
   <a for="body with type">body</a>.

   <li><p>If <var>body</var>'s <a for="body with type">type</a> is non-null and
   <var>response</var>'s <a for=response>header list</a> <a for="header list">does not contain</a>
   `<code>Content-Type</code>`, then <a for="header list">append</a> (`<code>Content-Type</code>`,
   <var>body</var>'s <a for="body with type">type</a>) to <var>response</var>'s
   <a for=response>header list</a>.
  </ol>
</ol>
</div>

<hr>

<div algorithm>
<p>The
<dfn constructor for=Response id=dom-response lt="Response(body, init)"><code>new Response(<var>body</var>, <var>init</var>)</code></dfn>
constructor steps are:

<ol>
 <li><p>Set <a>this</a>'s <a for=Response>response</a> to a new <a for=/>response</a>.

 <li><p>Set <a>this</a>'s <a for=Response>headers</a> to a <a for=/>new</a> {{Headers}} object with
 <a>this</a>'s <a>relevant Realm</a>, whose <a for=Headers>header list</a> is <a>this</a>'s
 <a for=Response>response</a>'s <a for=response>header list</a> and <a for=Headers>guard</a> is
 "<code>response</code>".

 <li><p>Let <var>bodyWithType</var> be null.

 <li><p>If <var>body</var> is non-null, then set <var>bodyWithType</var> to the result of
 <a for=BodyInit>extracting</a> <var>body</var>.

 <li><p>Perform <a>initialize a response</a> given <a>this</a>, <var>init</var>, and
 <var>bodyWithType</var>.
</ol>
</div>

<p>The static <dfn method for=Response><code>error()</code></dfn> method steps are to return the
result of <a for=Response>creating</a> a {{Response}} object, given a new <a>network error</a>,
"<code>immutable</code>", and <a>this</a>'s <a>relevant Realm</a>.

<div algorithm>
<p>The static
<dfn method for=Response><code>redirect(<var>url</var>, <var>status</var>)</code></dfn> method steps
are:

<ol>
 <li><p>Let <var>parsedURL</var> be the result of <a lt="URL parser">parsing</a> <var>url</var> with
 <a>current settings object</a>'s <a for="environment settings object">API base URL</a>.

 <li><p>If <var>parsedURL</var> is failure, then <a>throw</a> a {{TypeError}}.

 <li><p>If <var>status</var> is not a <a>redirect status</a>, then <a>throw</a> a {{RangeError}}.

 <li><p>Let <var>responseObject</var> be the result of <a for=Response>creating</a> a {{Response}}
 object, given a new <a for=/>response</a>, "<code>immutable</code>", and <a>this</a>'s
 <a>relevant Realm</a>.

 <li><p>Set <var>responseObject</var>'s <a for=Response>response</a>'s <a for=response>status</a> to
 <var>status</var>.

 <li><p>Let <var>value</var> be <var>parsedURL</var>, <a lt="URL serializer">serialized</a> and
 <a>isomorphic encoded</a>.

 <li><p><a for="header list">Append</a> (`<code>Location</code>`, <var>value</var>) to
 <var>responseObject</var>'s <a for=Response>response</a>'s <a for=response>header list</a>.

 <li><p>Return <var>responseObject</var>.
</ol>
</div>


<div algorithm>
<p>The static
<dfn method for=Response><code>json(<var>data</var>, <var>init</var>)</code></dfn> method steps
are:

<ol>
 <li><p>Let <var>bytes</var> the result of running <a>serialize a JavaScript value to JSON bytes</a>
 on <var>data</var>.

 <li><p>Let <var>body</var> be the result of <a for=BodyInit>extracting</a> <var>bytes</var>.

 <li><p>Let <var>responseObject</var> be the result of <a for=Response>creating</a> a {{Response}}
 object, given a new <a for=/>response</a>, "<code>response</code>", and <a>this</a>'s
 <a>relevant Realm</a>.

 <li><p>Perform <a>initialize a response</a> given <var>responseObject</var>, <var>init</var>, and
 (<var>body</var>, "<code>application/json</code>").

 <li><p>Return <var>responseObject</var>.
</ol>
</div>

<p>The <dfn attribute for=Response><code>type</code></dfn> getter steps are to return <a>this</a>'s
<a for=Response>response</a>'s <a for=response>type</a>.

<p>The <dfn attribute for=Response><code>url</code></dfn> getter steps are to return
the empty string if <a>this</a>'s <a for=Response>response</a>'s <a for=response>URL</a> is null;
otherwise <a>this</a>'s <a for=Response>response</a>'s <a for=response>URL</a>,
<a lt="URL serializer">serialized</a> with <a for="URL serializer"><i>exclude fragment</i></a> set
to true.

<p>The <dfn attribute for=Response><code>redirected</code></dfn> getter steps are to return true if
<a>this</a>'s <a for=Response>response</a>'s <a for=response>URL list</a> has more than one item;
otherwise false.

<p class=note>To filter out <a for=/>responses</a> that are the result of a
redirect, do this directly through the API, e.g., <code>fetch(url, { redirect:"error" })</code>.
This way a potentially unsafe <a for=/>response</a> cannot accidentally leak.

<p>The <dfn attribute for=Response><code>status</code></dfn> getter steps are to return
<a>this</a>'s <a for=Response>response</a>'s <a for=response>status</a>.

<p>The <dfn attribute for=Response><code>ok</code></dfn> getter steps are to return true if
<a>this</a>'s <a for=Response>response</a>'s <a for=response>status</a> is an <a>ok status</a>;
otherwise false.

<p>The <dfn attribute for=Response><code>statusText</code></dfn> getter steps are to return
<a>this</a>'s <a for=Response>response</a>'s <a for=response>status message</a>.

<p>The <dfn attribute for=Response><code>headers</code></dfn> getter steps are to return
<a>this</a>'s <a for=Response>headers</a>.

<hr>

<div algorithm>
<p>The <dfn method for=Response><code>clone()</code></dfn> method steps are:

<ol>
 <li><p>If <a>this</a> is <a for=Body>unusable</a>, then <a>throw</a> a {{TypeError}}.

 <li><p>Let <var>clonedResponse</var> be the result of <a lt=clone for=response>cloning</a>
 <a>this</a>'s <a for=Response>response</a>.

 <li><p>Return the result of <a for=Response>creating</a> a {{Response}} object, given
 <var>clonedResponse</var>, <a>this</a>'s <a for=Response>headers</a>'s <a for=Headers>guard</a>,
 and <a>this</a>'s <a>relevant Realm</a>.
</ol>
</div>


<h3 id=fetch-method>Fetch method</h3>

<pre class=idl>
partial interface mixin WindowOrWorkerGlobalScope {
  [NewObject] Promise&lt;Response> fetch(RequestInfo input, optional RequestInit init = {});
};
</pre>

<div algorithm>
<p>The
<dfn id=dom-global-fetch method for=WindowOrWorkerGlobalScope><code>fetch(<var>input</var>, <var>init</var>)</code></dfn>
method steps are:

<ol>
 <li><p>Let <var>p</var> be a new promise.

 <li><p>Let <var>requestObject</var> be the result of invoking the initial value of {{Request}} as
 constructor with <var>input</var> and <var>init</var> as arguments. If this throws an exception,
 <a for=/>reject</a> <var>p</var> with it and return <var>p</var>.

 <li><p>Let <var>request</var> be <var>requestObject</var>'s <a for=Request>request</a>.

 <li>
  <p>If <var>requestObject</var>'s <a for=Request>signal</a> is <a for=AbortSignal>aborted</a>,
  then:

  <ol>
   <li><p><a>Abort the <code>fetch()</code> call</a> with <var>p</var>, <var>request</var>, null, and
   <var>requestObject</var>'s <a for=Request>signal</a>'s <a for=AbortSignal>abort reason</a>.

   <li><p>Return <var>p</var>.
  </ol>

 <li>Let <var>globalObject</var> be  <var>request</var>'s <a for=request>client</a>'s
 <a for="environment settings object">global object</a>.

 <li>If <var>globalObject</var> is a {{ServiceWorkerGlobalScope}} object,
 then set <var>request</var>'s <a>service-workers mode</a> to "<code>none</code>".

 <li><p>Let <var>responseObject</var> be null.

 <li><p>Let <var>relevantRealm</var> be <a>this</a>'s <a>relevant Realm</a>.

 <li>
  <p>Let <var>locallyAborted</var> be false.

  <p class=note>This lets us reject promises with predictable timing, when the request to abort
  comes from the same thread as the call to fetch.

 <li><p>Let <var>controller</var> be null.

 <li>
  <p><a for=AbortSignal lt=add>Add the following abort steps</a> to <var>requestObject</var>'s
  <a for=Request>signal</a>:

  <ol>
   <li><p>Set <var>locallyAborted</var> to true.

   <li><p><a for=/>Assert</a>: <var>controller</var> is non-null.

   <li><p><a for="fetch controller">Abort</a> <var>controller</var> with <var>requestObject</var>'s
   <a for=Request>signal</a>'s <a for=AbortSignal>abort reason</a>.

   <li><p><a>Abort the <code>fetch()</code> call</a> with <var>p</var>, <var>request</var>,
   <var>responseObject</var>, and <var>requestObject</var>'s <a for=Request>signal</a>'s
   <a for=AbortSignal>abort reason</a>.
   <!-- ABORT-DUPLICATION
        This step would ideally be skipped for HTTP(S) requests, except that currently the HTTP
        cache integration with streams is not as good as it can be. Unfortunately we definitely need
        to do this for about:blank and blob: & data: URLs.

        The conceptual problem is that the underlying operation might not have been aborted by the
        time JavaScript gets a signal. See also:
        https://github.com/whatwg/dom/issues/1031#issuecomment-1233206400 -->
  </ol>

 <li>
  <p><p>Set <var>controller</var> to the result of calling <a for=/>fetch</a> given
  <var>request</var> and <a for=fetch><i>processResponse</i></a> given <var>response</var> being
  these steps:

  <ol>
   <li><p>If <var>locallyAborted</var> is true, then abort these steps.

   <li>
    <p>If <var>response</var>'s <a for=response>aborted flag</a> is set, then:

    <ol>
     <li><p>Let <var>deserializedError</var> be the result of
     <a>deserialize a serialized abort reason</a> given <var>controller</var>'s
     <a for="fetch controller">serialized abort reason</a> and <var>relevantRealm</var>.

     <li><p><a>Abort the <code>fetch()</code> call</a> with <var>p</var>, <var>request</var>,
     <var>responseObject</var>, and <var>deserializedError</var>.

     <li><p>Abort these steps.
    </ol>

   <li><p>If <var>response</var> is a <a>network error</a>, then <a for=/>reject</a> <var>p</var>
   with a {{TypeError}} and abort these steps.

   <li><p>Set <var>responseObject</var> to the result of <a for=Response>creating</a> a {{Response}}
   object, given <var>response</var>, "<code>immutable</code>", and <var>relevantRealm</var>.

   <li><p><a for=/>Resolve</a> <var>p</var> with <var>responseObject</var>.
  </ol>

 <li><p>Return <var>p</var>.
</ol>
</div>

<div algorithm>
<p>To <dfn lt="Abort the fetch() call" export id=abort-fetch>abort a <code>fetch()</code> call</dfn>
with a <var>promise</var>, <var>request</var>, <var>responseObject</var>, and an <var>error</var>:

<ol>
 <li>
  <p><a for=/>Reject</a> <var>promise</var> with <var>error</var>.

  <p class=note>This is a no-op if <var>promise</var> has already fulfilled.

 <li><p>If <var>request</var>'s <a for=request>body</a> is non-null and is
 <a for=ReadableStream>readable</a>, then <a for=ReadableStream>cancel</a> <var>request</var>'s
 <a for=request>body</a> with <var>error</var>.

 <li><p>If <var>responseObject</var> is null, then return.
 <!-- ABORT-DUPLICATION
      We might not need this and subsequent steps if we had better stream integration with the HTTP
      cache. However, about:blank and blob: & data: URLs would probably still need this as they do
      not have any cancelation logic. -->

 <li><p>Let <var>response</var> be <var>responseObject</var>'s <a for=Response>response</a>.

 <li><p>If <var>response</var>'s <a for=response>body</a> is non-null and is
 <a for=ReadableStream>readable</a>, then <a for=ReadableStream>error</a> <var>response</var>'s
 <a for=response>body</a> with <var>error</var>.
</ol>
</div>


<h3 id=garbage-collection>Garbage collection</h3>

<p>The user agent may <a for="fetch controller">terminate</a> an ongoing fetch if that termination
is not observable through script.

<p class=note>"Observable through script" means observable through
<a method><code>fetch()</code></a>'s arguments and return value. Other ways, such as communicating
with the server through a side-channel are not included.

<p class=note>The server being able to observe garbage collection has precedent, e.g., with
{{WebSocket}} and {{XMLHttpRequest}} objects.

<div class=example id=terminate-examples>
 <p>The user agent can terminate the fetch because the termination cannot be observed.
 <pre><code class=lang-javascript>
fetch("https://www.example.com/")
</code></pre>

 <p>The user agent cannot terminate the fetch because the termination can be observed through
 the promise.
 <pre><code class=lang-javascript>
window.promise = fetch("https://www.example.com/")
</code></pre>

 <p>The user agent can terminate the fetch because the associated body is not observable.
 <pre><code class=lang-javascript>
window.promise = fetch("https://www.example.com/").then(res => res.headers)
</code></pre>

 <p>The user agent can terminate the fetch because the termination cannot be observed.
 <pre><code class=lang-javascript>
fetch("https://www.example.com/").then(res => res.body.getReader().closed)
</code></pre>

 <p>The user agent cannot terminate the fetch because one can observe the termination by registering
 a handler for the promise object.
 <pre><code class=lang-javascript>
window.promise = fetch("https://www.example.com/")
  .then(res => res.body.getReader().closed)
</code></pre>

 <p>The user agent cannot terminate the fetch as termination would be observable via the registered
 handler.
 <pre><code class=lang-javascript>
fetch("https://www.example.com/")
  .then(res => {
    res.body.getReader().closed.then(() => console.log("stream closed!"))
  })
</code></pre>

  <p>(The above examples of non-observability assume that built-in properties and functions, such as
  {{ReadableStream/getReader()|body.getReader()}}, have not been overwritten.)
</div>



<h2 id=data-urls><code>data:</code> URLs</h2>

<p>For an informative description of <code>data:</code> URLs, see RFC 2397. This section replaces
that RFC's normative processing requirements to be compatible with deployed content. [[RFC2397]]

<p>A <dfn><code>data:</code> URL struct</dfn> is a <a>struct</a> that consists of a
<dfn for="data: URL struct">MIME type</dfn> (a <a for=/>MIME type</a>) and a
<dfn for="data: URL struct">body</dfn> (a <a>byte sequence</a>).

<div algorithm>
<p>The <dfn export><code>data:</code> URL processor</dfn> takes a <a for=/>URL</a>
<var>dataURL</var> and then runs these steps:

<ol>
 <li><p>Assert: <var>dataURL</var>'s <a for=url>scheme</a> is "<code>data</code>".

 <li><p>Let <var>input</var> be the result of running the <a>URL serializer</a> on
 <var>dataURL</var> with <a for="URL serializer"><i>exclude fragment</i></a> set to true.

 <li><p>Remove the leading "<code>data:</code>" from <var>input</var>.

 <li><p>Let <var>position</var> point at the start of <var>input</var>.

 <li><p>Let <var>mimeType</var> be the result of <a>collecting a sequence of code points</a> that
 are not equal to U+002C (,), given <var>position</var>.

 <li>
  <p><a>Strip leading and trailing ASCII whitespace</a> from <var>mimeType</var>.

  <p class="note">This will only remove U+0020 SPACE <a>code points</a>, if any.

 <li><p>If <var>position</var> is past the end of <var>input</var>, then return failure.

 <li><p>Advance <var>position</var> by 1.

 <li><p>Let <var>encodedBody</var> be the remainder of <var>input</var>.

 <li><p>Let <var>body</var> be the <a for=string>percent-decoding</a> of <var>encodedBody</var>.

 <li>
  <p>If <var>mimeType</var> ends with U+003B (;), followed by zero or more U+0020 SPACE, followed by
  an <a>ASCII case-insensitive</a> match for "<code>base64</code>", then:
  <!-- This really needs an ASCII case-insensitive ends with. -->

  <ol>
   <li><p>Let <var>stringBody</var> be the <a>isomorphic decode</a> of <var>body</var>.

   <li><p>Set <var>body</var> to the <a>forgiving-base64 decode</a> of <var>stringBody</var>.

   <li><p>If <var>body</var> is failure, then return failure.

   <li><p>Remove the last 6 <a>code points</a> from <var>mimeType</var>.

   <li><p>Remove trailing U+0020 SPACE <a>code points</a> from <var>mimeType</var>, if any.

   <li><p>Remove the last U+003B (;) from <var>mimeType</var>.
  </ol>

 <li><p>If <var>mimeType</var> <a for=string>starts with</a> "<code>;</code>", then prepend
 "<code>text/plain</code>" to <var>mimeType</var>.

 <li><p>Let <var>mimeTypeRecord</var> be the result of <a lt="parse a MIME type">parsing</a>
 <var>mimeType</var>.

 <li><p>If <var>mimeTypeRecord</var> is failure, then set <var>mimeTypeRecord</var> to
 <code>text/plain;charset=US-ASCII</code>.

 <li><p>Return a new <a><code>data:</code> URL struct</a> whose
 <a for="data: URL struct">MIME type</a> is <var>mimeTypeRecord</var> and
 <a for="data: URL struct">body</a> is <var>body</var>.
</ol>
</div>



<h2 id=background-reading class=no-num>Background reading</h2>

<p><em>This section and its subsections are informative only.</em>

<h3 id=http-header-layer-division dfn class=no-num>HTTP header layer division</h3>

<p>For the purposes of fetching, there is an API layer (HTML's <code>img</code>, CSS's
<code>background-image</code>), early fetch layer, service worker layer, and network &amp; cache
layer. `<code>Accept</code>` and `<code>Accept-Language</code>` are set in the early fetch layer
(typically by the user agent). Most other headers controlled by the user agent, such as
`<code>Accept-Encoding</code>`, `<code>Host</code>`, and `<code>Referer</code>`, are set in the
network &amp; cache layer. Developers can set headers either at the API layer or in the service
worker layer (typically through a {{Request}} object). Developers have almost no control over
<a>forbidden request-headers</a>, but can control `<code>Accept</code>` and have the means to
constrain and omit `<code>Referer</code>` for instance.


<h3 id=atomic-http-redirect-handling dfn class=no-num>Atomic HTTP redirect handling</h3>

<p>Redirects (a <a for=/>response</a> whose <a for=response>status</a> or
<a for="filtered response">internal response</a>'s (if any) <a for=response>status</a> is a
<a>redirect status</a>) are not exposed to APIs. Exposing redirects might leak information not
otherwise available through a cross-site scripting attack.

<p id=example-xss-redirect class=example>A fetch to <code>https://example.org/auth</code> that includes a
<code>Cookie</code> marked <code>HttpOnly</code> could result in a redirect to
<code>https://other-origin.invalid/4af955781ea1c84a3b11</code>. This new URL contains a
secret. If we expose redirects that secret would be available through a cross-site
scripting attack.


<h3 id=basic-safe-cors-protocol-setup class=no-num>Basic safe CORS protocol setup</h3>

<p>For resources where data is protected through IP authentication or a firewall
(unfortunately relatively common still), using the <a>CORS protocol</a> is
<strong>unsafe</strong>. (This is the reason why the <a>CORS protocol</a> had to be
invented.)

<p>However, otherwise using the following <a for=/>header</a> is
<strong>safe</strong>:

<pre><code class=lang-http>
Access-Control-Allow-Origin: *
</code></pre>

<p>Even if a resource exposes additional information based on cookie or HTTP
authentication, using the above <a for=/>header</a> will not reveal
it. It will share the resource with APIs such as
{{XMLHttpRequest}}, much like it is already shared with
<code>curl</code> and <code>wget</code>.

<p>Thus in other words, if a resource cannot be accessed from a random device connected to
the web using <code>curl</code> and <code>wget</code> the aforementioned
<a for=/>header</a> is not to be included. If it can be accessed
however, it is perfectly fine to do so.


<h3 id=cors-protocol-and-http-caches class=no-num>CORS protocol and HTTP caches</h3>

<p>If <a>CORS protocol</a> requirements are more complicated than setting
`<a http-header><code>Access-Control-Allow-Origin</code></a>` to <code>*</code> or a static
<a for=/>origin</a>, `<code>Vary</code>` is to be used.
[[!HTML]] [[!HTTP]] [[!HTTP-CACHING]]

<pre id=example-vary-origin class=example><code class=lang-http>
Vary: Origin
</code></pre>

<p>In particular, consider what happens if `<code>Vary</code>` is <em>not</em> used and a server is
configured to send `<a http-header><code>Access-Control-Allow-Origin</code></a>` for a certain
resource only in response to a <a>CORS request</a>. When a user agent receives a response to a
non-<a>CORS request</a> for that resource (for example, as the result of a <a>navigation
request</a>), the response will lack `<a http-header><code>Access-Control-Allow-Origin</code></a>`
and the user agent will cache that response. Then, if the user agent subsequently encounters a
<a>CORS request</a> for the resource, it will use that cached response from the previous
non-<a>CORS request</a>, without `<a http-header><code>Access-Control-Allow-Origin</code></a>`.

<p>But if `<code>Vary: Origin</code>` is used in the same scenario described above, it will cause
the user agent to <a for=/>fetch</a> a response that includes
`<a http-header><code>Access-Control-Allow-Origin</code></a>`, rather than using the cached response
from the previous non-<a>CORS request</a> that lacks
`<a http-header><code>Access-Control-Allow-Origin</code></a>`.

<p>However, if `<a http-header><code>Access-Control-Allow-Origin</code></a>` is set to
<code>*</code> or a static <a for=/>origin</a> for a particular resource, then configure the server
to always send `<a http-header><code>Access-Control-Allow-Origin</code></a>` in responses for the
resource — for non-<a>CORS requests</a> as well as <a>CORS
requests</a> — and do not use `<code>Vary</code>`.


<h3 class=no-num id=websocket-protocol oldids=websocket-connections,websocket-opening-handshake,fail-the-websocket-connection,the-websocket-connection-is-established>WebSockets</h2>

<p>As part of establishing a connection, the {{WebSocket}} object initiates a special kind of
<a for=/>fetch</a> (using a <a for=/>request</a> whose <a for=request>mode</a> is
"<code>websocket</code>") which allows it to share in many fetch policy decisions, such
<cite>HTTP Strict Transport Security (HSTS)</cite>. Ultimately this results in fetch calling into
<cite>WebSockets</cite> to obtain a dedicated connection. [[WEBSOCKETS]]
[[HSTS]]

<p class=note>Fetch used to define
<a id=concept-websocket-connection-obtain>obtain a WebSocket connection</a> and
<a spec=websockets id=concept-websocket-establish>establish a WebSocket connection</a> directly, but
both are now defined in <cite>WebSockets</cite>. [[WEBSOCKETS]]



<h2 id=fetch-elsewhere class=no-num>Using fetch in other standards</h2>

<p>In its essence <a for=/>fetching</a> is an exchange of a <a for=/>request</a> for a
<a for=/>response</a>. In reality it is rather complex mechanism for standards to adopt and use
correctly. This section aims to give some advice.

<p class=warning>Always ask domain experts for review.

<p class=XXX>This is a work in progress.


<h3 id=fetch-elsewhere-request>Setting up a request</h3>

<p>The first step in <a for=/>fetching</a> is to create a <a for=/>request</a>, and populate its
<a for=struct>items</a>.

<p>Start by setting the <a for=/>request</a>'s <a for=request>URL</a> and <a for=request>method</a>,
as defined by HTTP. If your `<code>POST</code>` or `<code>PUT</code>` <a for=/>request</a> needs a
body, you set <a for=/>request</a>'s <a for=request>body</a> to a <a for=/>byte sequence</a>, or to
a new <a for=/>body</a> whose <a for=body>stream</a> is a {{ReadableStream}} you created. [[HTTP]]

<p>Choose your <a for=/>request</a>'s <a for=request>destination</a> using the guidance in the
<a href="#destination-table">destination table</a>. <a for=request>Destinations</a> affect
<cite>Content Security Policy</cite> and have other implications such as the [:Sec-Fetch-Dest:]
header, so they are much more than informative metadata. If a new feature requires a
<a for=request>destination</a> that's not in the <a href="#destination-table">destination table</a>,
please
<a href="https://github.com/whatwg/fetch/issues/new?title=What%20destination%20should%20my%20feature%20use">file an issue</a>
to discuss. [[CSP]]

<p>Set your <a for=/>request</a>'s <a for=request>client</a> to the
<a>environment settings object</a> you're operating in. Web-exposed APIs are generally defined with
Web IDL, for which every object that implements an <a>interface</a> has a
<a>relevant settings object</a> you can use. For example, a <a for=/>request</a> associated with an
<a for=/>element</a> would set the <a for=/>request</a>'s <a for=request>client</a> to the element's
<a>node document</a>'s <a>relevant settings object</a>. All features that are directly web-exposed
by JavaScript, HTML, CSS, or other {{Document}} subresources should have a
<a for=request>client</a>.

<p>If your <a for=/>fetching</a> is not directly web-exposed, e.g., it is sent in the background
without relying on a current {{Window}} or {{Worker}}, leave <a for=/>request</a>'s
<a for=request>client</a> as null and set the <a for=/>request</a>'s <a for=request>origin</a>,
<a for=request>policy container</a>, <a for=request>service-workers mode</a>, and
<a for=request>referrer</a> to appropriate values instead, e.g., by copying them from the
<a>environment settings object</a> ahead of time. In these more advanced cases, make sure the
details of how your fetch handles <cite>Content Security Policy</cite> and
<a for=/>referrer policy</a> are fleshed out. Also make sure you handle concurrency, as callbacks
(see [[#fetch-elsewhere-fetch]]) would be posted on a <a>parallel queue</a>. [[REFERRER]] [[CSP]]

<p>Think through the way you intend to handle cross-origin resources. Some features may only work in
the <a>same origin</a>, in which case set your <a for=/>request</a>'s <a for=request>mode</a> to
"<code>same-origin</code>". Otherwise, new web-exposed features should almost always set their
<a for=request>mode</a> to "<code>cors</code>". If your feature is not web-exposed, or you think
there is another reason for it to fetch cross-origin resources without CORS, please
<a href="https://github.com/whatwg/fetch/issues/new?title=Does%20my%20request%20require%20CORS">file an issue</a>
to discuss.

<p>For cross-origin requests, also determines if <a for=/>credentials</a> are to be included with
the requests, in which case set your <a for=/>request</a>'s <a for=request>credentials mode</a> to
"<code>include</code>".

<p>Figure out if your fetch needs to be reported to <cite>Resource Timing</cite>, and with which
<a for=request>initiator type</a>. By passing an <a for=request>initiator type</a> to the
<a for=/>request</a>, reporting to <cite>Resource Timing</cite> will be done automatically once the
fetch is done and the <a for=/>response</a> is fully downloaded. [[RESOURCE-TIMING]]

<p>If your request requires additional HTTP headers, set its <a for=request>header list</a> to
a <a for=/>header list</a> that contains those headers, e.g., « (`<code>My-Header-Name</code>`,
`<code>My-Header-Value</code>`) ». Sending custom headers may have implications, such as requiring a
<a>CORS-preflight fetch</a>, so handle with care.

<p>If you want to override the default caching mechanism, e.g., disable caching for this
<a for=/>request</a>, set the request's <a for=request>cache mode</a> to a value other than
"<code>default</code>".

<p>Determine whether you want your request to support redirects. If you don't, set its
<a for=request>redirect mode</a> to "<code>error</code>".

<p>Browse through the rest of the parameters for <a for=/>request</a> to see if something else is
relevant to you. The rest of the parameters are used less frequently, often for special purposes,
and they are documented in detail in the [[#requests]] section of this standard.


<h3 id=fetch-elsewhere-fetch class=no-num>Invoking fetch</h3>

<p>Aside from a <a for=/>request</a> the <a for=/>fetch</a> operation takes several optional
arguments. For those arguments that take an algorithm: the algorithm will be called from a task (or
in a <a for=/>parallel queue</a> if <a for=fetch><i>useParallelQueue</i></a> is true).

<dl>
 <dt><a for=fetch><i>processRequestBodyChunkLength</i></a>
 <dd><p>Takes an algorithm that will be passed the number of bytes that have been transmitted from
 the <a for=/>request</a>'s <a for=request>body</a>. The algorithm will be invoked for each
 transmitted chunk. Most standards will not need this.

 <dt><a for=fetch><i>processRequestEndOfBody</i></a>
 <dd><p>Takes an algorithm that will be passed nothing. Indicates <a for=/>request</a>'s
 <a for=request>body</a> has been transmitted. Most standards will not need this.

 <dt><a for=fetch><i>processEarlyHintsResponse</i></a>
 <dd><p>Takes an algorithm that will be passed a <a for=/>response</a> (whose
 <a for=response>status</a> is 103). Can only be used for navigations as defined by
 <cite>HTML</cite>. [[HTML]]

 <dt><a for=fetch><i>processResponse</i></a>
 <dd>
  <p>Takes an algorithm that will be passed a <a for=/>response</a>. Indicates
  <a for=/>response</a>'s <a for=response>header list</a> has been received and initialized. This
  is primarily useful for standards that want to operate on <a for=/>response</a>'s
  <a for=response>body</a>'s <a for=body>stream</a> directly.

  <p>If the <a for=/>request</a>'s <a for=request>mode</a> is "<code>navigate</code>" and its
  <a for=request>redirect mode</a> is "<code>manual</code>", then callers need to follow a very
  specific flow with this algorithm to get the intended behavior. They should compute the
  appropriate <a for=response>location URL</a>, and if it is non-null or failure, then they should
  call <a for="fetch controller">process the next manual redirect</a>. This will result in
  <a for=fetch><i>processResponse</i></a> being called again, with the next <a for=/>response</a>
  in the redirect chain.

 <dt><a for=fetch><i>processResponseEndOfBody</i></a>
 <dd><p>Takes an algorithm that will be passed a <a for=/>response</a>. Indicates the network is
 done transmitting the response. This does not read <a for=/>response</a>'s
 <a for=response>body</a>.

 <dt><a for=fetch><i>processResponseConsumeBody</i></a>
 <dd>
  <p>Takes an algorithm that will be passed a <a for=/>response</a> and null, failure, or a
  <a>byte sequence</a>. This is useful for standards that wish to operate on the entire
  <a for=/>response</a>'s <a for=response>body</a>, of which the result of reading it is supplied as
  second argument. The second argument's values have the following meaning:

  <dl>
   <dt>null
   <dd>The <a for=/>response</a>'s <a for=response>body</a> is null, due to the response being a
   <a for=/>network error</a> or having a <a>null body status</a>.

   <dt>failure
   <dd>Attempting to <a for=body>fully read</a> the contents of the <a for=/>response</a>'s
   <a for=response>body</a> failed, e.g., due to an I/O error.

   <dt>a <a>byte sequence</a>
   <dd><a for=body>Fully reading</a> the contents of the <a for=/>response</a>'s
   <a for=response>body</a> succeeded.
  </dl>

  <p class=warning>A standard that uses this argument cannot operate on <a for=/>response</a>'s
  <a for=response>body</a> itself as providing this argument will cause it to be read and it can be
  read only once.

 <dt><a for=fetch><i>useParallelQueue</i></a>
 <dd><p>Takes a <a for=/>boolean</a> that defaults to false. Indicates where the algorithms passed
 as arguments will be invoked. Hopefully most standards will not need this.
</dl>

<p>When invoked, the <a for=/>fetch</a> operation returns a <a for=/>fetch controller</a>. The
controller is used for performing actions on a fetch operation that has already started, such as
<a for="fetch controller" lt=abort>aborting</a> the operation by the user or page logic, or
<a for="fetch controller" lt=terminate>terminating</a> it due to a browser-internal circumstance.



<h2 id=acknowledgments class=no-num>Acknowledgments</h2>

<p>Thanks to
Adam Barth,
Adam Lavin,
Alan Jeffrey,
Alexey Proskuryakov,
Andrés Gutiérrez,
Andrew Sutherland,
Ángel González,
Anssi Kostiainen,
Arkadiusz Michalski,
Arne Johannessen,
Artem Skoretskiy,
Arthur Barstow,
Arthur Sonzogni, <!-- ArthurSonzogni; GitHub -->
Asanka Herath,
Axel Rauschmayer,
Ben Kelly,
Benjamin Gruenbaum,
Benjamin Hawkes-Lewis,
Bert Bos,
Björn Höhrmann,
Boris Zbarsky,
Brad Hill,
Brad Porter,
Bryan Smith,
Caitlin Potter,
Cameron McCormack,
Chirag S Kumar<!-- fictionistique; GitHub -->,
Chris Needham,
Chris Rebert,
Clement Pellerin,
Collin Jackson,
Daniel Robertson,
Daniel Veditz,
Dave Tapuska,
David Benjamin,
David Håsäther,
David Orchard,
Dean Jackson,
Devdatta Akhawe,
Domenic Denicola,
Dominic Farolino,
Dominique Hazaël-Massieux,
Doug Turner,
Douglas Creager,
Eero Häkkinen,
Ehsan Akhgari,
Emily Stark,
Eric Lawrence,
Eric Orth,
François Marier,
Frank Ellerman,
Frederick Hirsch,
Frederik Braun,
Gary Blackwood,
Gavin Carothers,
Glenn Maynard,
Graham Klyne,
Gregory Terzian,
Hal Lockhart,
Hallvord R. M. Steen,
Harris Hancock,
Henri Sivonen,
Henry Story,
Hiroshige Hayashizaki,
Honza Bambas,
Ian Hickson,
Ilya Grigorik,
isonmad,
Jake Archibald<!-- technically B.J. Archibald -->,
James Graham,
Janusz Majnert,
Jeena Lee,
Jeff Carpenter,
Jeff Hodges,
Jeffrey Yasskin,
Jensen Chappell,
Jeremy Roman,
Jesse M. Heines,
Jianjun Chen,
Jinho Bang,
Jochen Eisinger,
John Wilander,
Jonas Sicking,
Jonathan Kingston,
Jonathan Watt,
최종찬 (Jongchan Choi),
Jordan Stephens,
Jörn Zaefferer,
Joseph Pecoraro,
Josh Matthews,
jub0bs<!-- GitHub -->,
Julian Krispel-Samsel,
Julian Reschke,
송정기 (Jungkee Song),
Jussi Kalliokoski,
Jxck,
Kagami Sascha Rosylight,
Keith Yeung,
Kenji Baheux,
Lachlan Hunt,
Larry Masinter,
Liam Brummitt,
Linus Groh,
Louis Ryan,
Luca Casonato,
Lucas Gonze,
Łukasz Anforowicz,
呂康豪 (Kang-Hao Lu),
Maciej Stachowiak,
Malisa<!-- malisas; GitHub -->,
Manfred Stock,
Manish Goregaokar,
Marc Silbey,
Marcos Caceres,
Marijn Kruisselbrink,
Mark Nottingham,
Mark S. Miller,
Martin Dürst,
Martin O'Neal<!-- dramatic-bishop; GitHub -->,
Martin Thomson,
Matt Andrews,
Matt Falkenhagen,
Matt Menke,
Matt Oshry,
Matt Seddon,
Matt Womer,
Mhano Harkness,
Michael Ficarra,
Michael Kohler,
Michael™ Smith,
Mike Pennisi,
Mike West,
Mohamed Zergaoui,
Mohammed Zubair Ahmed<!-- M-ZubairAhmed; GitHub -->,
Moritz Kneilmann,
Ms2ger,
Nico Schlömer,
Nicolás Peña Moreno,
Nidhi Jaju,
Nikhil Marathe,
Nikki Bee,
Nikunj Mehta,
Noam Rosenthal,
Odin Hørthe Omdal,
Olli Pettay,
Ondřej Žára,
O. Opsec,
Patrick Meenan,
Perry Jiang<!-- perryjiang; Github -->,
Philip Jägenstedt,
R. Auburn,
Raphael Kubo da Costa,
Robert Linder,
Rondinelly,
Rory Hewitt,
Ross A. Baker,
Ryan Sleevi,
Samy Kamkar,
Sébastien Cevey,
Sendil Kumar N,
Shao-xuan Kang,
Sharath Udupa,
Shivakumar Jagalur Matt,
Shivani Sharma,
Sigbjørn Finne,
Simon Pieters,
Simon Sapin,
Srirama Chandra Sekhar Mogali,
Stephan Paul,
Steven Salat,
Sunava Dutta,
Surya Ismail,
Tab Atkins-Bittner,
Takashi Toyoshima,
吉野剛史 (Takeshi Yoshino),
Thomas Roessler,
Thomas Steiner,
Thomas Wisniewski,
Tiancheng "Timothy" Gu,
Tobie Langel,
Tom Schuster,
Tomás Aparicio,
triple-underscore<!-- GitHub -->,
保呂毅 (Tsuyoshi Horo),
Tyler Close,
Ujjwal Sharma,
Vignesh Shanmugam,
Vladimir Dzhuvinov,
Wayne Carr,
Xabier Rodríguez,
Yehuda Katz,
Yoav Weiss,
Youenn Fablet<!-- youennf; GitHub -->,
Yoichi Osato,
平野裕 (Yutaka Hirano), and
Zhenbin Xu
for being awesome.

<p>This standard is written by <a href=https://annevankesteren.nl/ lang=nl>Anne van Kesteren</a>
(<a href=https://www.apple.com/>Apple</a>, <a href=mailto:annevk@annevk.nl>annevk@annevk.nl</a>).