Re: [w3c/ServiceWorker] OpenWindow lacks either sourceDocument or userInvolvement argument when running Navigate algorithm (Issue #1776)

domenic left a comment (w3c/ServiceWorker#1776)

> Where does the navigate algorithm affect the referrer? That was actually the reason to look at this and to me it looks like it never sets referrer. It's a complex algorithm so perhaps I'm just reading it wrong.

Step 12 of [create and initialize a `Document` object](https://html.spec.whatwg.org/#initialise-the-document-object) sets the referrer from _navigationParams_'s request's referrer.

The fetch algorithm is generally responsible for setting a given request's referrer, in https://fetch.spec.whatwg.org/#concept-main-fetch step 9.

The algorithm it uses, https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer, is highly dependent on the fetch client. It seems to crash if the client is null. (Fix PR: https://github.com/w3c/webappsec-referrer-policy/pull/175.)

> I'm not sure I understand this point; openWindow requires transient user activation to be called, so presumably it should be set to true here?

Thanks, I didn't read enough about openWindow to know that it required user activation.

What the source snapshot params "has transient activation" impacts:

- Interaction with "sandboxed top-level navigation with/without user activation"
- The request's user activation flag, which I believe underlies `Sec-Fetch-User`

I wonder what browsers currently send for `Sec-Fetch-User` when doing `openWindow()`.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1776#issuecomment-2947564394
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/issues/1776/2947564394@github.com>