diff --git a/fetch.bs b/fetch.bs index aac85636d..b93223a09 100755 --- a/fetch.bs +++ b/fetch.bs @@ -618,6 +618,35 @@ are always combined when exposed to client-side JavaScript, implementations coul efficient representation, as long as they also support an associated data structure for `Set-Cookie` headers. +

A header list has an associated +hidden range value +(null or a header value). It is initially null. + +

+

This is for cases where a "no-cors" request needs to include a + `Range` header, but it can not be exposed via {{Headers}}. It can be set by privileged + APIs, and will be preserved if its associated request object is copied, but will be removed if the + request is modified by unprivileged APIs. + +

`Range` headers are commonly used by downloads + and media fetches. + +

A helper is provided to add a range header to a particular request. +

+ +
+

To get the range value +from a header list list, run these steps. They return null or a +header value. + +

    +

  1. If list contains `Range`, then return the + result of getting `Range` from list. + +

  2. Return list's hidden range value. +

+
+

To get a structured field value @@ -881,6 +910,22 @@ directly. Use get, decode, and split instead. byte-case-insensitive match for name from list.

+
+

To empty a +header list list: + +

    +

  1. Empty list. + +

  2. Set list's hidden range value to null. +

+
+ +

A header list list +is empty +if list is empty and list's +hidden range value is null. +

To set a header (name, value) in a header list list: @@ -1140,23 +1185,6 @@ following is true:

A CORS non-wildcard request-header name is a header name that is a byte-case-insensitive match for `Authorization`. -

A privileged no-CORS request-header name is a header name that is -a byte-case-insensitive match for one of - -

- -
-

These are headers that can be set by privileged APIs, and will be preserved if their associated - request object is copied, but will be removed if the request is modified by unprivileged APIs. - -

`Range` headers are commonly used by downloads - and media fetches. - -

A helper is provided to add a range header to a particular request. -

-

A CORS-safelisted response-header name, given a list of header names list, is a header name that is a byte-case-insensitive match for one of @@ -2446,8 +2474,8 @@ is to return the result of serializing a request origin with request

  • If last is given, then serialize and isomorphic encode it, and append the result to rangeValue. -

  • Append (`Range`, rangeValue) to - request's header list. +

  • Set request's header list's + hidden range value to rangeValue.

    A range header denotes an inclusive byte range. There a range header where @@ -4710,7 +4738,7 @@ the response. [[!HTTP-CACHING]]

  • request's method is `GET`

  • request's unsafe-request flag is not set or - request's header list is empty + request's header list is empty

    then: @@ -5126,10 +5154,10 @@ steps:

  • If response's type is "opaque", internalResponse's status is a range status, - internalResponse's range-requested flag is set, and - request's header list does not contain - `Range`, then set response and internalResponse to a - network error. + internalResponse's range-requested flag is set, and the result of + getting the range value from request's + header list is null, then set response and + internalResponse to a network error.

    Traditionally, APIs accept a ranged response even if a range was not requested. This prevents @@ -5556,9 +5584,13 @@ returning a response directly, or allowing the request to proceed by returning n

  • Let type be blob's {{Blob/type}}. +

  • Let rangeHeader be the result of getting the range + value from request's header list. + +

  • -

    If request's header list - does not contain `Range`: +

    If rangeHeader is null:

    1. Let bodyWithType be the result of safely extracting @@ -5580,11 +5612,6 @@ returning a response directly, or allowing the request to proceed by returning n

      1. Set response's range-requested flag. -

      2. Let rangeHeader be the result of getting - `Range` from request's header list. - -

      3. Let rangeValue be the result of parsing a single range header value given rangeHeader and true. @@ -6251,6 +6278,12 @@ run these steps:

      +

    2. If httpRequest's header list's + hidden range value is non-null, then append + (`Range`, httpRequest's header list's + hidden range value) to httpRequest's + header list. +

    3. If httpRequest's header list contains `Range`, then append (`Accept-Encoding`, @@ -7989,17 +8022,8 @@ value (for {{Headers/delete()}}) that always succeeds in CORS-safelisted requ

      To remove privileged no-CORS request-headers -from a {{Headers}} object (headers), run these steps: - -

        -

      1. For each headerName of - privileged no-CORS request-header names: - -

          -

        1. Delete headerName from headers's - header list. -

        -
      +from a {{Headers}} object (headers), set headers's +header list's hidden range value to null.

      This is called when headers are modified by unprivileged code.

      @@ -8032,8 +8056,7 @@ method steps are to append (name, value

      Passing a dummy header value ought not to have any negative repercussions.

    4. If this's guard is "request-no-cors", name - is not a no-CORS-safelisted request-header name, and name is not a - privileged no-CORS request-header name, then return. + is not a no-CORS-safelisted request-header name, then return.

    5. If this's header list does not contain name, then return. @@ -9076,7 +9099,8 @@ constructor steps are:

    6. If init["{{RequestInit/headers}}"] exists, then set headers to init["{{RequestInit/headers}}"]. -

    7. Empty this's headers's header list. +

    8. Empty this's headers's + header list.

    9. If headers is a {{Headers}} object, then for each header of its header list, append