HTML integration plan about webappsec-referrer-policy

[annevk]

"API referrer source" is now basically the environment settings object itself rather than a field on it, passed to fetch as request's client. (Or you can set an explicit referrer through request's referrer.)

[domenic]

@annevk with that in mind do you have a suggestion for how to fix https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer step 3.3.2? It doesn't seem obvious to me.

[annevk]

I think for a worker you'd just inspect the worker itself for the referrer policy. That would be analogous to CSP. What it states now seems wrong, but I might be missing something?

[domenic]

I was hoping for some explicit text, or a pull request on top of my #42 :)

[estark37]

@domenic did you happen to already have a plan for fixing the "API referrer source" reference in https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer? I wonder if it should be the creation URL of the environment settings object...

[domenic]

I don't have a plan; I was hoping @annevk would give more concrete suggestions. But maybe this isn't so bad after all...

I wonder if it should be the creation URL of the environment settings object...

I believe that is correct, for the worker case. For the document case, the current text seems correct, although I'm not sure on the difference between the responsible browsing context's active document, and the responsible document.

The algorithm looks like it could be cleaned up a decent bit. Here is my draft to replace the current step 3:

1. If request's referrer is a URL, then let referrerSource be request's referrer.
2. Otherwise,
   1. If environment's global object is a Window object, then
      1. Let document be the active document of environment's responsible browsing context.
      2. If document's origin is an opaque origin, return "no-referrer" and abort this algorithm.
      3. While document is an iframe srcdoc document, let document be document's browsing context's browsing context container's Document.
      4. Let referrerSource be document's URL.
   2. Otherwise, let referrerSource be environment's creation URL.

[domenic]

In a series of wonderful pull requests (whatwg/html#1641 whatwg/html#1649 whatwg/html#1651) @estark37 finished this off!