From fb9259d4ac186eb11ec0aa31539f489609dff2a8 Mon Sep 17 00:00:00 2001
From: Benjamin VanderSloot <bvandersloot@mozilla.com>
Date: Fri, 31 Jan 2025 13:12:38 -0500
Subject: [PATCH] Add the request initiator origin and fix its use

---
 fetch.bs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fetch.bs b/fetch.bs
index e65c51056..8c426e1a1 100644
--- a/fetch.bs
+++ b/fetch.bs
@@ -67,7 +67,6 @@ urlPrefix:https://www.ietf.org/archive/id/draft-annevk-johannhof-httpbis-cookies
 urlPrefix:https://html.spec.whatwg.org#;type:dfn;spec:html
     url:TODO;text:ancestry;for:environment
     url:TODO;text:has storage access;for:environment
-    url:TODO;text:initiator origin;for:request
 </pre>
 
 <pre class=biblio>
@@ -1957,6 +1956,10 @@ not always relevant and might require different behavior.
 "<code>client</code>" or an <a for=/>origin</a>. Unless stated otherwise it is
 "<code>client</code>".
 
+<p>A <a for=/>request</a> has an associated
+<dfn export for=request id=concept-request-navigation-initiator-origin>navigation initiator origin</dfn>, which is
+an <a for=/>origin</a> or null. Unless stated otherwise it is null.
+
 <p class=note>"<code>client</code>" is changed to an <a for=/>origin</a> during
 <a lt=fetch for=/>fetching</a>. It provides a convenient way for standards to not have to set
 <a for=/>request</a>'s <a for=request>origin</a>.
@@ -3385,11 +3388,11 @@ given a <a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var
 <p>To <dfn>determine the same-site mode</dfn> for a given <a for=/>request</a> <var>request</var>, run these steps:
   <ol>
    <li><p><a for=/>Assert</a>: <var>request</var>'s <a for=request>method</a> is "GET" or "POST".
+   <li><p>If <var>request</var>'s <a for=request>navigation initiator origin</a> is not null and is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
    <li><p>If <var>request</var>'s <a for=request>method</a> is "GET" and
     <var>request</var>'s <a for=request>destination</a> is "document", return "<code>LaxOrLess</code>".
    <li><p>If <var>request</var>'s <a for=request>client</a>'s <a for=environment>ancestry</a> is "<code>cross-site</code>", return "<code>UnsetOrLess</code>".
    <li><p>If <var>request</var>'s <a for=request>redirect-taint</a> is "<code>Cross-Site</code>", return "<code>UnsetOrLess</code>".
-   <li><p>If <var>request</var>'s <a for=request>initiator origin</a> is not <a for=/>same site</a> to <var>request</var>'s <a for=request>URL</a>'s <a for=url>origin</a>, return "<code>UnsetOrLess</code>".
    <li><p>Return "StrictOrLess".
   </ol>
 </div>