Fetch

To report timing for a fetch controller controller given a global object global:

1. Assert: controller’s report timing steps is non-null.

2. Call controller’s report timing steps with global.

To process the next manual redirect for a fetch controller controller:

1. Assert: controller’s next manual redirect steps is non-null.

2. Call controller’s next manual redirect steps.

To extract full timing info given a fetch controller controller:

1. Assert: controller’s full timing info is non-null.

2. Return controller’s full timing info.

To abort a fetch controller controller with an optional error:

1. Set controller’s state to "aborted".

2. Let fallbackError be an "AbortError" DOMException.

3. Set error to fallbackError if it is not given.

4. Let serializedError be StructuredSerialize(error). If that threw an exception, catch it, and let serializedError be StructuredSerialize(fallbackError).

5. Set controller’s serialized abort reason to serializedError.

To deserialize a serialized abort reason, given null or a Record abortReason and a realm realm:

1. Let fallbackError be an "AbortError" DOMException.

2. Let deserializedError be fallbackError.

3. If abortReason is non-null, then set deserializedError to StructuredDeserialize(abortReason, realm). If that threw an exception or returned undefined, then set deserializedError to fallbackError.

4. Return deserializedError.

To terminate a fetch controller controller, set controller’s state to "terminated".

To create an opaque timing info, given a fetch timing info timingInfo, return a new fetch timing info whose start time and post-redirect start time are timingInfo’s start time.

To queue a fetch task, given an algorithm algorithm, a global object or a parallel queue taskDestination, run these steps:

1. If taskDestination is a parallel queue, then enqueue algorithm to taskDestination.

2. Otherwise, queue a global task on the networking task source with taskDestination and algorithm.

To check if the environment settings object environment is offline:

• If the user agent assumes it does not have internet connectivity, then return true.

• Return environment’s WebDriver BiDi network is offline.

To collect an HTTP quoted string from a string input, given a position variable position and an optional boolean extract-value (default false):

1. Let positionStart be position.

2. Let value be the empty string.

3. Assert: the code point at position within input is U+0022 (").

4. Advance position by 1.

5. While true:

   1. Append the result of collecting a sequence of code points that are not U+0022 (") or U+005C (\) from input, given position, to value.

   2. If position is past the end of input, then break.

   3. Let quoteOrBackslash be the code point at position within input.

   4. Advance position by 1.

   5. If quoteOrBackslash is U+005C (\), then:

      1. If position is past the end of input, then append U+005C (\) to value and break.

      2. Append the code point at position within input to value.

      3. Advance position by 1.

   6. Otherwise:

      1. Assert: quoteOrBackslash is U+0022 (").

      2. Break.

6. If extract-value is true, then return value.

7. Return the code points from positionStart to position, inclusive, within input.

To get a structured field value given a header name name and a string type from a header list list, run these steps. They return null or a structured field value.

1. Assert: type is one of "dictionary", "list", or "item".

2. Let value be the result of getting name from list.

3. If value is null, then return null.

4. Let result be the result of parsing structured fields with input_string set to value and header_type set to type.

5. If parsing failed, then return null.

6. Return result.

Get a structured field value intentionally does not distinguish between a header not being present and its value failing to parse as a structured field value. This ensures uniform processing across the web platform.

To set a structured field value given a tuple (header name name, structured field value structuredValue), in a header list list:

1. Let serializedValue be the result of executing the serializing structured fields algorithm on structuredValue.

2. Set (name, serializedValue) in list.

Structured field values are defined as objects which HTTP can (eventually) serialize in interesting and efficient ways. For the moment, Fetch only supports header values as byte sequences, which means that these objects can be set in header lists only via serialization, and they can be obtained from header lists only by parsing. In the future the fact that they are objects might be preserved end-to-end. [RFC9651]

A header list list contains a header name name if list contains a header whose name is a byte-case-insensitive match for name.

To get a header name name from a header list list, run these steps. They return null or a header value.

1. If list does not contain name, then return null.

2. Return the values of all headers in list whose name is a byte-case-insensitive match for name, separated from each other by 0x2C 0x20, in order.

To get, decode, and split a header name name from header list list, run these steps. They return null or a list of strings.

1. Let value be the result of getting name from list.

2. If value is null, then return null.

3. Return the result of getting, decoding, and splitting value.

To get, decode, and split a header value value, run these steps. They return a list of strings.

1. Let input be the result of isomorphic decoding value.

2. Let position be a position variable for input, initially pointing at the start of input.

3. Let values be a list of strings, initially « ».

4. Let temporaryValue be the empty string.

5. While true:

   1. Append the result of collecting a sequence of code points that are not U+0022 (") or U+002C (,) from input, given position, to temporaryValue.

      The result might be the empty string.

   2. If position is not past the end of input and the code point at position within input is U+0022 ("):

      1. Append the result of collecting an HTTP quoted string from input, given position, to temporaryValue.

      2. If position is not past the end of input, then continue.

   3. Remove all HTTP tab or space from the start and end of temporaryValue.

   4. Append temporaryValue to values.

   5. Set temporaryValue to the empty string.

   6. If position is past the end of input, then return values.

   7. Assert: the code point at position within input is U+002C (,).

   8. Advance position by 1.

Except for blessed call sites, the algorithm directly above is not to be invoked directly. Use get, decode, and split instead.

To append a header (name, value) to a header list list:

1. If list contains name, then set name to the first such header’s name.

   This reuses the casing of the name of the header already in list, if any. If there are multiple matched headers their names will all be identical.

2. Append (name, value) to list.

To delete a header name name from a header list list, remove all headers whose name is a byte-case-insensitive match for name from list.

To set a header (name, value) in a header list list:

1. If list contains name, then set the value of the first such header to value and remove the others.

2. Otherwise, append (name, value) to list.

To combine a header (name, value) in a header list list:

1. If list contains name, then set the value of the first such header to its value, followed by 0x2C 0x20, followed by value.

2. Otherwise, append (name, value) to list.

Combine is used by XMLHttpRequest and the WebSocket protocol handshake.

To convert header names to a sorted-lowercase set, given a list of names headerNames, run these steps. They return an ordered set of header names.

1. Let headerNamesSet be a new ordered set.

2. For each name of headerNames, append the result of byte-lowercasing name to headerNamesSet.

3. Return the result of sorting headerNamesSet in ascending order with byte less than.

To sort and combine a header list list, run these steps. They return a header list.

1. Let headers be a header list.

2. Let names be the result of convert header names to a sorted-lowercase set with all the names of the headers in list.

3. For each name of names:

   1. If name is `set-cookie`, then:

      1. Let values be a list of all values of headers in list whose name is a byte-case-insensitive match for name, in order.

      2. For each value of values:

         1. Append (name, value) to headers.

   2. Otherwise:

      1. Let value be the result of getting name from list.

      2. Assert: value is non-null.

      3. Append (name, value) to headers.

4. Return headers.

To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.

To determine whether a header (name, value) is a CORS-safelisted request-header, run these steps:

1. If value’s length is greater than 128, then return false.

2. Byte-lowercase name and switch on the result:

   `accept`

   If value contains a CORS-unsafe request-header byte, then return false.

   `accept-language`

   `content-language`

   If value contains a byte that is not in the range 0x30 (0) to 0x39 (9), inclusive, is not in the range 0x41 (A) to 0x5A (Z), inclusive, is not in the range 0x61 (a) to 0x7A (z), inclusive, and is not 0x20 (SP), 0x2A (*), 0x2C (,), 0x2D (-), 0x2E (.), 0x3B (;), or 0x3D (=), then return false.

   `content-type`

   1. If value contains a CORS-unsafe request-header byte, then return false.

   2. Let mimeType be the result of parsing the result of isomorphic decoding value.

   3. If mimeType is failure, then return false.

   4. If mimeType’s essence is not "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", then return false.

   This intentionally does not use extract a MIME type as that algorithm is rather forgiving and servers are not expected to implement it.

   If extract a MIME type were used the following request would not result in a CORS preflight and a naïve parser on the server might treat the request body as JSON:

   fetch("https://victim.example/naïve-endpoint", {
     method: "POST",
     headers: [
       ["Content-Type", "application/json"],
       ["Content-Type", "text/plain"]
     ],
     credentials: "include",
     body: JSON.stringify(exerciseForTheReader)
   });
   

   `range`

   1. Let rangeValue be the result of parsing a single range header value given value and false.

   2. If rangeValue is failure, then return false.

   3. If rangeValue[0] is null, then return false.

      As web browsers have historically not emitted ranges such as `bytes=-500` this algorithm does not safelist them.

   Otherwise

   Return false.

3. Return true.

There are limited exceptions to the `Content-Type` header safelist, as documented in CORS protocol exceptions.

A CORS-unsafe request-header byte is a byte byte for which one of the following is true:

• byte is less than 0x20 and is not 0x09 HT

• byte is 0x22 ("), 0x28 (left parenthesis), 0x29 (right parenthesis), 0x3A (:), 0x3C (<), 0x3E (>), 0x3F (?), 0x40 (@), 0x5B ([), 0x5C (\), 0x5D (]), 0x7B ({), 0x7D (}), or 0x7F DEL.

The CORS-unsafe request-header names, given a header list headers, are determined as follows:

1. Let unsafeNames be a new list.

2. Let potentiallyUnsafeNames be a new list.

3. Let safelistValueSize be 0.

4. For each header of headers:

   1. If header is not a CORS-safelisted request-header, then append header’s name to unsafeNames.

   2. Otherwise, append header’s name to potentiallyUnsafeNames and increase safelistValueSize by header’s value’s length.

5. If safelistValueSize is greater than 1024, then for each name of potentiallyUnsafeNames, append name to unsafeNames.

6. Return the result of convert header names to a sorted-lowercase set with unsafeNames.

To determine whether a header (name, value) is a no-CORS-safelisted request-header, run these steps:

1. If name is not a no-CORS-safelisted request-header name, then return false.

2. Return whether (name, value) is a CORS-safelisted request-header.

A header (name, value) is forbidden request-header if these steps return true:

1. If name is a byte-case-insensitive match for one of:

   • `Accept-Charset`
   • `Accept-Encoding`
   • `Access-Control-Request-Headers`
   • `Access-Control-Request-Method`
   • `Connection`
   • `Content-Length`
   • `Cookie`
   • `Cookie2`
   • `Date`
   • `DNT`
   • `Expect`
   • `Host`
   • `Keep-Alive`
   • `Origin`
   • `Referer`
   • `Set-Cookie`
   • `TE`
   • `Trailer`
   • `Transfer-Encoding`
   • `Upgrade`
   • `Via`

   then return true.

2. If name when byte-lowercased starts with `proxy-` or `sec-`, then return true.

3. If name is a byte-case-insensitive match for one of:

   • `X-HTTP-Method`
   • `X-HTTP-Method-Override`
   • `X-Method-Override`

   then:

   1. Let parsedValues be the result of getting, decoding, and splitting value.

   2. For each method of parsedValues: if the isomorphic encoding of method is a forbidden method, then return true.

4. Return false.

To extract header values given a header header, run these steps:

1. If parsing header’s value, per the ABNF for header’s name, fails, then return failure.

2. Return one or more values resulting from parsing header’s value, per the ABNF for header’s name.

To extract header list values given a header name name and a header list list, run these steps:

1. If list does not contain name, then return null.

2. If the ABNF for name allows a single header and list contains more than one, then return failure.

   If different error handling is needed, extract the desired header first.

3. Let values be an empty list.

4. For each header header list contains whose name is name:

   1. Let extract be the result of extracting header values from header.

   2. If extract is failure, then return failure.

   3. Append each value in extract, in order, to values.

5. Return values.

To build a content range given an integer rangeStart, an integer rangeEnd, and an integer fullLength, run these steps:

1. Let contentRange be `bytes `.

2. Append rangeStart, serialized and isomorphic encoded, to contentRange.

3. Append 0x2D (-) to contentRange.

4. Append rangeEnd, serialized and isomorphic encoded to contentRange.

5. Append 0x2F (/) to contentRange.

6. Append fullLength, serialized and isomorphic encoded to contentRange.

7. Return contentRange.

To parse a single range header value from a byte sequence value and a boolean allowWhitespace, run these steps:

1. Let data be the isomorphic decoding of value.

2. If data does not start with "bytes", then return failure.

3. Let position be a position variable for data, initially pointing at the 5th code point of data.

4. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.

5. If the code point at position within data is not U+003D (=), then return failure.

6. Advance position by 1.

7. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.

8. Let rangeStart be the result of collecting a sequence of code points that are ASCII digits, from data given position.

9. Let rangeStartValue be rangeStart, interpreted as decimal number, if rangeStart is not the empty string; otherwise null.

10. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.

11. If the code point at position within data is not U+002D (-), then return failure.

12. Advance position by 1.

13. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.

14. Let rangeEnd be the result of collecting a sequence of code points that are ASCII digits, from data given position.

15. Let rangeEndValue be rangeEnd, interpreted as decimal number, if rangeEnd is not the empty string; otherwise null.

16. If position is not past the end of data, then return failure.

17. If rangeEndValue and rangeStartValue are null, then return failure.

18. If rangeStartValue and rangeEndValue are numbers, and rangeStartValue is greater than rangeEndValue, then return failure.

19. Return (rangeStartValue, rangeEndValue).

    The range end or start can be omitted, e.g., `bytes=0-` or `bytes=-500` are valid ranges.

Parse a single range header value succeeds for a subset of allowed range header values, but it is the most common form used by user agents when requesting media or resuming downloads. This format of range header value can be set using add a range header.

To get the environment settings object environment’s environment default `User-Agent` value:

1. Let userAgent be the WebDriver BiDi emulated User-Agent for environment.

2. If userAgent is non-null, then return userAgent, isomorphic encoded.

3. Return the default `User-Agent` value.

To clone a body body, run these steps:

1. Let « out1, out2 » be the result of teeing body’s stream.

2. Set body’s stream to out1.

3. Return a body whose stream is out2 and other members are copied from body.

To get a byte sequence bytes as a body, return the body of the result of safely extracting bytes.

To incrementally read a body body, given an algorithm processBodyChunk, an algorithm processEndOfBody, an algorithm processBodyError, and an optional null, parallel queue, or global object taskDestination (default null), run these steps. processBodyChunk must be an algorithm accepting a byte sequence. processEndOfBody must be an algorithm accepting no arguments. processBodyError must be an algorithm accepting an exception.

1. If taskDestination is null, then set taskDestination to the result of starting a new parallel queue.

2. Let reader be the result of getting a reader for body’s stream.

   This operation will not throw an exception.

3. Perform the incrementally-read loop given reader, taskDestination, processBodyChunk, processEndOfBody, and processBodyError.

To perform the incrementally-read loop, given a ReadableStreamDefaultReader object reader, parallel queue or global object taskDestination, algorithm processBodyChunk, algorithm processEndOfBody, and algorithm processBodyError:

1. Let readRequest be the following read request:

   chunk steps, given chunk

   1. Let continueAlgorithm be null.

   2. If chunk is not a Uint8Array object, then set continueAlgorithm to this step: run processBodyError given a TypeError.

   3. Otherwise:

      1. Let bytes be a copy of chunk.

         Implementations are strongly encouraged to use an implementation strategy that avoids this copy where possible.

      2. Set continueAlgorithm to these steps:

         1. Run processBodyChunk given bytes.

         2. Perform the incrementally-read loop given reader, taskDestination, processBodyChunk, processEndOfBody, and processBodyError.

   4. Queue a fetch task given continueAlgorithm and taskDestination.

   close steps

   1. Queue a fetch task given processEndOfBody and taskDestination.

   error steps, given e

   1. Queue a fetch task to run processBodyError given e, with taskDestination.

2. Read a chunk from reader given readRequest.

To fully read a body body, given an algorithm processBody, an algorithm processBodyError, and an optional null, parallel queue, or global object taskDestination (default null), run these steps. processBody must be an algorithm accepting a byte sequence. processBodyError must be an algorithm optionally accepting an exception.

1. If taskDestination is null, then set taskDestination to the result of starting a new parallel queue.

2. Let successSteps given a byte sequence bytes be to queue a fetch task to run processBody given bytes, with taskDestination.

3. Let errorSteps optionally given an exception exception be to queue a fetch task to run processBodyError given exception, with taskDestination.

4. Let reader be the result of getting a reader for body’s stream. If that threw an exception, then run errorSteps with that exception and return.

5. Read all bytes from reader, given successSteps and errorSteps.

To handle content codings given codings and bytes, run these steps:

1. If codings are not supported, then return bytes.

2. Return the result of decoding bytes with codings as explained in HTTP, if decoding does not result in an error, and failure otherwise. [HTTP]

To compute the redirect-taint of a request request, perform the following steps. They return "same-origin", "same-site", or "cross-site".

1. Assert: request’s origin is not "client".

2. Let lastURL be null.

3. Let taint be "same-origin".

4. For each url of request’s URL list:

   1. If lastURL is null, then set lastURL to url and continue.

   2. If url’s origin is not same site with lastURL’s origin and request’s origin is not same site with lastURL’s origin, then return "cross-site".

   3. If url’s origin is not same origin with lastURL’s origin and request’s origin is not same origin with lastURL’s origin, then set taint to "same-site".

   4. Set lastURL to url.

5. Return taint.

Serializing a request origin, given a request request, is to run these steps:

1. Assert: request’s origin is not "client".

2. If request’s redirect-taint is not "same-origin", then return "null".

3. Return request’s origin, serialized.

Byte-serializing a request origin, given a request request, is to return the result of serializing a request origin with request, isomorphic encoded.

To clone a request request, run these steps:

1. Let newRequest be a copy of request, except for its body.

2. If request’s body is non-null, set newRequest’s body to the result of cloning request’s body.

3. Return newRequest.

To add a range header to a request request, with an integer first, and an optional integer last, run these steps:

1. Assert: last is not given, or first is less than or equal to last.

2. Let rangeValue be `bytes=`.

3. Serialize and isomorphic encode first, and append the result to rangeValue.

4. Append 0x2D (-) to rangeValue.

5. If last is given, then serialize and isomorphic encode it, and append the result to rangeValue.

6. Append (`Range`, rangeValue) to request’s header list.

A range header denotes an inclusive byte range. There a range header where first is 0 and last is 500, is a range of 501 bytes.

Features that combine multiple responses into one logical resource are historically a source of security bugs. Please seek security review for features that deal with partial responses.

To serialize a response URL for reporting, given a response response, run these steps:

1. Assert: response’s URL list is not empty.

2. Let url be a copy of response’s URL list[0].

   This is not response’s URL in order to avoid leaking information about redirect targets (see similar considerations for CSP reporting too). [CSP]

3. Set the username given url and the empty string.

4. Set the password given url and the empty string.

5. Return the serialization of url with exclude fragment set to true.

To check if Cross-Origin-Embedder-Policy allows credentials, given a request request, run these steps:

1. Assert: request’s origin is not "client".

2. If request’s mode is not "no-cors", then return true.

3. If request’s client is null, then return true.

4. If request’s client’s policy container’s embedder policy’s value is not "credentialless", then return true.

5. If request’s origin is same origin with request’s current URL’s origin and request’s redirect-taint is not "same-origin", then return true.

6. Return false.

To create the appropriate network error given fetch params fetchParams:

1. Assert: fetchParams is canceled.

2. Return an aborted network error if fetchParams is aborted; otherwise return a network error.