Skip to content

fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs #5738

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tsctx merged 2 commits into from
Sep 4, 2026
+9 −7
Merged

fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs #5738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1edf05c
fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs
kjsik11 Aug 30, 2026
fe69384
test: drop fetch-metadata unit test covered by WPT
kjsik11 Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion lib/web/fetch/util.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,14 +227,19 @@ function TAOCheck () {
return 'success'
}

// https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request
function appendFetchMetadata (httpRequest) {
// 1. If r’s url is not a potentially trustworthy URL, return.
if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
return
}

// https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-dest-header
// TODO

// https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header

// 1. Assert: r’s url is a potentially trustworthy URL.
// TODO

// 2. Let header be a Structured Header whose value is a token.
let header = null
Expand Down
9 changes: 3 additions & 6 deletions test/web-platform-tests/expectation.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18298,18 +18298,15 @@
},
{
"name": "sec-fetch-mode - Not sent to non-trustworthy same-origin destination, no init",
"success": false,
"message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
"success": true
},
{
"name": "sec-fetch-mode - Not sent to non-trustworthy same-site destination, no init",
"success": false,
"message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
"success": true
},
{
"name": "sec-fetch-mode - Not sent to non-trustworthy cross-site destination, no init",
"success": false,
"message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
"success": true
},
{
"name": "sec-fetch-dest - Not sent to non-trustworthy same-origin destination, no init",
Expand Down
Loading