The following terms are defined in Fetch:
about:blankRequestCredentials enumerationLet browsingContext be navigationParams's browsing context.
If any of the following are true:
response is a network error.
TODO: Define X-Frame-Options processing here (tracked
- as issue #1230).
The Should navigation response to navigation request of type from source in target
- be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon navigationParams's request, response,
- navigationType, source, and navigationParams's browsing context.
-
The result of checking a - navigation response's adherence to its embedder policy with response and - navigationParams's browsing - context is false.
response is a network error;
the result of should navigation response to navigation request of type from source
+ in target be blocked by Content Security Policy? given navigationParams's
+ request, response,
+ navigationType, source, and browsingContext is "Blocked";
the result of checking a navigation response's adherence to
+ `X-Frame-Options` given response, browsingContext,
+ and navigationParams's origin is
+ false; or
the result of checking a navigation response's adherence to its embedder policy given + response and browsingContext is false.
then:
Display the inline content with an appropriate error - shown to the user given navigationParams's browsing context.
Run the environment discarding steps for navigationParams's Location { // but see also browsing - context is true, then handle response as a download.
Return.
application/atom+xml MIME type), or one for which the user agent has a dedicated
handler.
An explicitly supported JSON MIME type is a JSON MIME type for which the user agent is configured to use an external application to render the content (either a - plugin rendering directly in navigationParams's browsing context, or a separate application), - or one for which the user agent has dedicated processing rules, or one for which the user agent - has a dedicated handler.
+ plugin rendering directly in browsingContext, or a separate + application), or one for which the user agent has dedicated processing rules, or one for which + the user agent has a dedicated handler. + data-x="navigate-ua-inline">display the inline content given browsingContext, + and then return.Otherwise, the document's type is such that the resource will not affect - navigationParams's browsing - context, e.g., because the resource is to be handed to an external application or because - it is an unknown type that will be processed as a download. Process the resource appropriately.
+ browsingContext, e.g., because the resource is to be handed to an external application + or because it is an unknown type that will be processed as a download. Process the resource appropriately.To process a navigate URL scheme, given a URL url and @@ -84831,6 +84832,221 @@ interface BeforeUnloadEvent : Event { +
X-Frame-Options` headerThe ` In particular, HTTP Header Field X-Frame-Options specified an ` Per the below processing model, ifIf
+ both a CSP For web developers and conformance checkers, its value ABNF
+ is: To check a navigation response's adherence to ` If browsingContext is not a child browsing context, then return
+ true. For each policy of response's CSP list: If policy's disposition is not " If policy's directive set contains a Let rawXFrameOptions be the result of getting, decoding, and splitting
+ ` Let xFrameOptions be a new set. For each value of
+ rawXFrameOptions, append value,
+ converted to ASCII lowercase, to xFrameOptions. If xFrameOptions's size is greater than 1, and
+ xFrameOptions contains any of " The intention here is to block any attempts at applying
+ ` This is the only impact of the legacy ` If xFrameOptions's size is greater than 1, then
+ return true. This means it contains multiple invalid values, which we treat the same way as
+ if the header was omitted entirely. If xFrameOptions[0] is " If xFrameOptions[0] is " Let containerDocument be browsingContext's container document. While containerDocument is not null: If containerDocument's origin is not same origin
+ with destinationOrigin, then return false. Let containerBC be containerDocument's browsing context. Set containerDocument to containerBC's container document, if containerBC is
+ non-null; otherwise, null. Return true. If we've reached this point then we have a lone invalid value (which could
+ potentially be one the legacy ` The following table illustrates the processing of various values for the header, including
+ non-conformant ones: The following table illustrates how various non-conformant cases involving multiple values are
+ processed: The same results are obtained whether the values are delivered in a single header whose value is comma-delimited,
+ or in multiple headers. This section describes a header for registration in the Permanent Message Header Field
+ Registry. This section describes a convention for use with the IANA URI scheme registry. It does not
@@ -122237,6 +122476,9 @@ INSERT INTERFACES HERE
X-Frame-Options` HTTP response header is a legacy way of controlling whether
+ and how a Document may be loaded inside of a child browsing context. It
+ is obsoleted by the frame-ancestors CSP directive,
+ which provides more granular control over the same situations. It was originally defined in
+ HTTP Header Field X-Frame-Options, but the definition and processing
+ model here supersedes that document.
+
+ ALLOW-FROM` variant of the header, but that is not to be implemented.frame-ancestors directive and an
+ `X-Frame-Options` header are used in the same response, then `X-Frame-Options` is ignored.
+
+ X-Frame-Options = "DENY" / "SAMEORIGIN"X-Frame-Options`, given
+ a response response, a browsing
+ context browsingContext, and an origin
+ destinationOrigin:
+
+
+
+
+ enforce", then continue.frame-ancestors directive, then return true.X-Frame-Options` from response's header list.deny", "allowall", or "sameorigin", then return false.X-Frame-Options` which were trying to do something valid, but appear confused.ALLOWALL` value
+ on the processing model.deny", then return
+ false.sameorigin", then:
+
+
+
+ ALLOWALL` or `ALLOW-FROM` forms). These are treated as if the header were omitted
+ entirely.
+
+
+
+
+
+
+
+
+ `
+ X-Frame-Options`Valid
+ Result
+
+
+ `
+ DENY`✅
+ embedding disallowed
+
+
+ `
+ SAMEORIGIN`✅
+ same-origin embedding allowed
+
+
+ `
+ INVALID`❌
+ embedding allowed
+
+
+ `
+ ALLOWALL`❌
+ embedding allowed
+
+
+
+ `
+ ALLOW-FROM=https://example.com/`❌
+ embedding allowed (from anywhere)
+
+
+
+
+
+
+
+
+ `
+ X-Frame-Options`Result
+
+
+ `
+ SAMEORIGIN, SAMEORIGIN`same-origin embedding allowed
+
+
+ `
+ SAMEORIGIN, DENY`embedding disallowed
+
+
+ `
+ SAMEORIGIN,`embedding disallowed
+
+
+ `
+ SAMEORIGIN, ALLOWALL`embedding disallowed
+
+
+ `
+ SAMEORIGIN, INVALID`embedding disallowed
+
+
+ `
+ ALLOWALL, INVALID`embedding disallowed
+
+
+ `
+ ALLOWALL,`embedding disallowed
+
+
+
+ `
+ INVALID, INVALID`embedding allowed
+ Offline web applications
@@ -117289,6 +117505,29 @@ interface External {
+ `
+
+ X-Frame-Options`
+
+
+
web+ scheme prefix