Re: [whatwg/fetch] Define preconnect and dns-prefetch with CSP (PR #1620)

@annevk commented on this pull request.

Apologies for the delay here. Found a couple more issues to address.

> +  <p class=note>The user agent can attempt to initiate a preconnect and perform the full
+  connection handshake (DNS+TCP for HTTP, and DNS+TCP+TLS for HTTPS origins) whenever possible, but
+  is allowed to elect to perform a partial handshake (DNS only for HTTP, and DNS or DNS+TCP for
+  HTTPS origins), or skip it entirely, due to resource constraints or other reasons.</p>
+
+  <p class=note>The optimal number of connections per origin is dependent on the negotiated
+  protocol, users current connectivity profile, available device resources, global connection
+  limits, and other context specific variables. As a result, the decision for how many connections
+  should be opened is deferred to the user agent.</p>

These notes feel like normative material. One even contains "should"! In the step above where we obtain the connection perhaps we should have a "with these caveats" ending that then leads into some bullet points?

> +  limits, and other context specific variables. As a result, the decision for how many connections
+  should be opened is deferred to the user agent.</p>
+</ol>
+</div>
+
+<div algorithm>
+<p>To <dfn export>preemptively resolve an origin</dfn>, given an
+<a>environment settings object</a> <var>environment</var> and a <a for=/>URL</a> <var>url</var>, run
+these steps:
+
+<ol>
+ <li><p>Let <var>key</var> be the result of <a for=/>determining the network partition key</a> given
+ <var>environment</var>.
+
+ <li>Run <p><a>determine if Content Security Policy allows connection</a> with
+ <var>environment</var> and <var>url</var>. If that returns false, return.

```suggestion
 <var>environment</var> and <var>url</var>. If that returns false, then return.
```

> +</ol>
+</div>
+
+<div algorithm>
+<p>To <dfn>determine if Content Security Policy allows connection</dfn>, given an
+<a>environment settings object</a> <var>environment</var>, and a <a for=/>URL</a> <var>url</var>:
+
+<ol>
+ <li><p>Let <var>request</var> be a <a for=/>request</a> whose <a for=request>URL</a> is
+ <var>url</var>, <a for=request>initiator</a> is "<code>prefetch</code>", and whose
+ <a for=request>client</a> is <var>environment</var>.
+
+ <li><p>Let <var>result</var> be the result of running
+ <a>should request be blocked by Content Security Policy?</a> given <var>request</var>.
+
+ <li><p>Return true if <var>result</var> is <b>allowed</b>, otherwise false.

```suggestion
 <li><p>Return true if <var>result</var> is <b>allowed</b>; otherwise false.
```

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1620#pullrequestreview-1648597936
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1620/review/1648597936@github.com>