Re: [whatwg/fetch] Define preconnect and dns-prefetch with CSP (PR #1620)

@annevk commented on this pull request.



> @@ -2846,16 +2846,7 @@ steps:
    <a>connection</a>.
   </ol>
 
- <li>
-  <p>Let <var>proxies</var> be the result of finding proxies for <var>url</var> in an
-  <a>implementation-defined</a> manner. If there are no proxies, let <var>proxies</var> be
-  « "<code>DIRECT</code>" ».
-
-  <p class=note>This is where non-standard technology such as
-  <a href="https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol">Web Proxy Auto-Discovery Protocol (WPAD)</a>
-  and <a href="https://en.wikipedia.org/wiki/Proxy_auto-config">proxy auto-config (PAC)</a> come
-  into play. The "<code>DIRECT</code>" value means to not use a proxy for this particular
-  <var>url</var>.
+ <li><p>Let <var>proxies</var> of calling <a>resolve proxies</a>.

This is missing words.

> +<p>To <dfn>resolve proxies</dfn>, return the result of finding proxies for <var>url</var> in an
+<a>implementation-defined</a> manner. If there are no proxies, return « "<code>DIRECT</code>" ».

Where does _url_ come from here? If it needs to be an argument, let's make it explicit.

> @@ -3023,6 +3027,75 @@ details of reused connections are not exposed and time values are coarsened.
 </div>
 
 
+<h3 id=preemptive-connections>Preemptive connections</h3>
+
+<div algorithm="preemmptively-obtain-a-connection">

Does algorithm need this value? Normally it works without.

> +  <p><a>Check CSP for preemptive operation</a> with <var>environment</var> and <var>url</var>. If
+  that returns <b>allowed</b>, <a>obtain a connection</a> with <var>key</var>, <var>url</var> and
+  <var>credentials</var>.

Oxford comma.

> +<div algorithm="check-preemptive-operation-csp">
+<p>To <dfn>check CSP for preemptive operation</dfn>, given an
+<a>environment settings object</a> <var>environment</var>, and a <a for=/>URL</a> <var>url</var>,
+run these steps:

> Perhaps this can have a more descriptive name such as "does CSP allow a connection" and we normalize the return value from CSP to true/false while we're here.

Seems this went unaddressed?

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1620#pullrequestreview-1412544059
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1620/review/1412544059@github.com>