-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Should downloads be "navigate" or "no-cors" #5548
Comments
Chromium has also implemented this with the request mode "navigate." https://bugs.chromium.org/p/chromium/issues/detail?id=1082429 This has some implications for CORB, as noted in fetch:
The pull request which introduced that note may contain the discussion @annevk's thinking of. I'm having some trouble understanding the distinction between "mode" and "destination" in this case. That may partly be due to the term "navigation request"--a request whose destination is "document." It seems strange that a request can have a mode of "navigate" but not be considered a "navigation request." |
I suspect we'd change destination to " |
Chromium implements both kinds of downloads as If you'd like to add |
There's mode and there's destination. It sounds like we agree that mode should be "navigate". Should destination be "document" as it is for other navigations? That seems fine to me, but I thought I'd offer a different value. (Thinking about it some more a different value might be tricky though given the cross-origin behavior and redirects and such.) |
I wonder if |
Looks like neither the spec nor Chrome consider |
That's not entirely true, see #7718. |
Sorry, I meant the download-only path does not respect But at least in Chrome, if the download-only path is hit (conditions are here) |
CSP is apparently applied differently between Also while I was investigating this, I found that the |
I posit that downloads are inherently a "top-level navigation," and should be treated as such. |
Currently in the standard some downloads are the result of navigation and others are the result of the
download
attribute, which ostensibly fetches directly, but can also navigate, e.g., if you use<a download=x href=https://www.example.com/>test</a>
outside of example.com.I suspect that due to redirects and such it really should just be an input to the navigate algorithm and therefore the mode ought to be "navigate".
This disconnect has a broader impact now due to the existence of the
Sec-Fetch-Mode
header, see https://bugzilla.mozilla.org/show_bug.cgi?id=1637747.(I'm pretty sure this was discussed before, but I cannot find the issue.)
cc @mikewest @ckerschb
The text was updated successfully, but these errors were encountered: