Send Sec-Purpose: prefetch header for prefetch requests

[noamr]

Send Sec-Purpose: prefetch for prefetch requests

The purpose headers allows servers to discern between regular requests
and "resource hints" - requests that are only meant to populate
caches.

This replaces the existing Purpose and x-moz: prefetch headers.

Closes w3c/webappsec-fetch-metadata#84
Closes w3c/resource-hints#74
Part of whatwg/html#8111

• At least two implementers are interested (and none opposed):

  • Chromium
  • Apple: Request for position: aligning on <link rel=prefetch> WebKit/standards-positions#114
  • Aligning on behavior of prefetch mozilla/standards-positions#723

• Tests are written and can be reviewed and commented upon at:

  • Add multiple tests for prefetch behavior web-platform-tests/wpt#35707

• Implementation bugs are filed:

  • Chrome:
    1358419: Sec-Purpose header
  • Firefox:
    1788167: Align prefetch with spec
  • Safari: https://bugs.webkit.org/show_bug.cgi?id=194539

• MDN issue is filed: Update prefetch link once the spec and implementations are finalized mdn/content#23553

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[mnot]

If this lands, please don't forget to register the header.

[annevk]

That's a good point. Let's define this header then in its own section in HTTP extensions?

Also, we should probably define it as a structured header given that its new and use https://fetch.spec.whatwg.org/#concept-header-list-set-structured-header to set it.

[noamr]

That's a good point. Let's define this header then in its own section in HTTP extensions?

Also, we should probably define it as a structured header given that its new and use https://fetch.spec.whatwg.org/#concept-header-list-set-structured-header to set it.

Done, hope this is right :)

[noamr]

@annevk all the checkboxes for this and for whatwg/html#8111 are ticked! Anything missing?

[annevk]

I pushed some more commits. This looks good now. (Once the HTML PR is approved I will merge this.)

[annevk]

Header registration: protocol-registries/http-fields#37.

[jeremyroman]

The WebKit bug link looks incorrect; did you intend to link a different bug?

[annevk]

@jeremyroman thank you, I found a more suitable reference.