diff --git a/index.bs b/index.bs index 260d5a6..2cc0903 100644 --- a/index.bs +++ b/index.bs @@ -404,6 +404,13 @@ Per [[RFC6265BIS-14#name-storage-model|Cookies § Storage Model]], a [=cookie=] +
+ +To normalize a cookie name or value given a [=/string=] |input|: +remove all U+0009 TAB and U+0020 SPACE that are at the start or end of |input|. + +
+ A cookie is script-visible when it is in-scope and its [=cookie/http-only-flag=] is unset. This is more formally enforced in the processing model, which consults [[RFC6265BIS-14#name-retrieval-model|Cookies § Retrieval Model]] at appropriate points. A cookie is also subject to certain size limits. Per [[RFC6265BIS-14#name-storage-model|Cookies § Storage Model]]: @@ -548,7 +555,7 @@ The get(|options|) method steps are: 1. Run the following steps [=in parallel=]: 1. Let |list| be the results of running [=query cookies=] with |url| and - |options|["{{CookieStoreGetOptions/name}}"] (if present). + |options|["{{CookieStoreGetOptions/name}}"] [=map/with default=] null. 1. If |list| is failure, then [=reject=] |p| with a {{TypeError}} and abort these steps. 1. If |list| [=list/is empty=], then [=/resolve=] |p| with null. 1. Otherwise, [=/resolve=] |p| with the first item of |list|. @@ -605,7 +612,7 @@ The getAll(|options|) method steps are: 1. Run the following steps [=in parallel=]: 1. Let |list| be the results of running [=query cookies=] with |url| and - |options|["{{CookieStoreGetOptions/name}}"] (if present). + |options|["{{CookieStoreGetOptions/name}}"] [=map/with default=] null. 1. If |list| is failure, then [=reject=] |p| with a {{TypeError}}. 1. Otherwise, [=/resolve=] |p| with |list|. 1. Return |p|. @@ -781,6 +788,7 @@ The subscribe(|subscriptions|) method s 1. Let |subscription list| be |registration|'s associated [=cookie change subscription list=]. 1. [=list/For each=] |entry| in |subscriptions|, run these steps: 1. Let |name| be |entry|["{{CookieStoreGetOptions/name}}"]. + 1. [=Normalize=] |name|. 1. Let |url| be the result of [=basic URL parser|parsing=] |entry|["{{CookieStoreGetOptions/url}}"] with |settings|'s [=environment settings object/API base URL=]. 1. If |url| does not start with |registration|'s [=service worker registration/scope url=], then [=reject=] |p| with a {{TypeError}} and abort these steps. @@ -837,6 +845,7 @@ The unsubscribe(|subscriptions|) method 1. Let |subscription list| be |registration|'s associated [=cookie change subscription list=]. 1. [=list/For each=] |entry| in |subscriptions|, run these steps: 1. Let |name| be |entry|["{{CookieStoreGetOptions/name}}"]. + 1. [=Normalize=] |name|. 1. Let |url| be the result of [=basic URL parser|parsing=] |entry|["{{CookieStoreGetOptions/url}}"] with |settings|'s [=environment settings object/API base URL=]. 1. If |url| does not start with |registration|'s [=service worker registration/scope url=], then [=reject=] |p| with a {{TypeError}} and abort these steps. @@ -1006,10 +1015,7 @@ and return a [=byte sequence=] corresponding to the closest `cookie-date` repres
-To query cookies with -|url| and -optional |name|, -run the following steps: +To query cookies given a [=/URL=] |url| and [=/string=]-or-null |name|: 1. Perform the steps defined in [[RFC6265BIS-14#name-retrieval-model|Cookies § Retrieval Model]] to compute the "cookie-string from a given cookie store" with |url| as request-uri. @@ -1020,7 +1026,8 @@ run the following steps: 1. Let |list| be a new [=/list=]. 1. [=list/For each=] |cookie| in |cookie-list|, run these steps: 1. Assert: |cookie|'s [=cookie/http-only-flag=] is false. - 1. If |name| is given, then run these steps: + 1. If |name| is non-null: + 1. [=Normalize=] |name|. 1. Let |cookieName| be the result of running [=UTF-8 decode without BOM=] on |cookie|'s [=cookie/name=]. 1. If |cookieName| does not equal |name|, then [=iteration/continue=]. @@ -1059,8 +1066,8 @@ optional |expires|, |partitioned| run the following steps: -1. Remove all U+0009 TAB and U+0020 SPACE that are at the start or end of |name|. -1. Remove all U+0009 TAB and U+0020 SPACE that are at the start or end of |value|. +1. [=Normalize=] |name|. +1. [=Normalize=] |value|. 1. If |name| or |value| contain U+003B (;), any [=C0 control=] character except U+0009 TAB, or U+007F DELETE, then return failure. ISSUE(httpwg/http-extensions#1593): Note that it's up for discussion whether these character restrictions should also apply to |expires|, |domain|, |path|, and |sameSite| as well. @@ -1138,6 +1145,8 @@ run the following steps: Note: The exact value of |expires| is not important for the purposes of this algorithm, as long as it is in the past. +1. [=Normalize=] |name|. + 1. Let |value| be the empty string. 1. If |name|'s [=string/length=] is 0, then set |value| to any non-empty [=implementation-defined=] string.