1. 2.4 URLs
      1. 2.4.1 Terminology
      2. 2.4.2 CORS settings attributes
      3. 2.4.3 Referrer policy attributes
      4. 2.4.4 Nonce attributes

2.4 URLs

2.4.1 Terminology

A string is a valid non-empty URL if it is a valid URL string but it is not the empty string.

A string is a valid URL potentially surrounded by spaces if, after stripping leading and trailing ASCII whitespace from it, it is a valid URL string.

A string is a valid non-empty URL potentially surrounded by spaces if, after stripping leading and trailing ASCII whitespace from it, it is a valid non-empty URL.

This specification defines the URL about:legacy-compat as a reserved, though unresolvable, about: URL, for use in DOCTYPEs in HTML documents when needed for compatibility with XML tools. [ABOUT]

This specification defines the URL about:html-kind as a reserved, though unresolvable, about: URL, that is used as an identifier for kinds of media tracks. [ABOUT]

This specification defines the URL about:srcdoc as a reserved, though unresolvable, about: URL, that is used as the URL of iframe srcdoc documents. [ABOUT]

The fallback base URL of a Document object document is the URL record obtained by running these steps:

  1. If document is an iframe srcdoc document, then return the document base URL of document's browsing context's browsing context container's node document.

  2. If document's URL is about:blank, and document's browsing context has a creator browsing context, then return the creator base URL.

  3. Return document's URL.

The document base URL of a Document object is the absolute URL obtained by running these steps:

  1. If there is no base element that has an href attribute in the Document, then return the Document's fallback base URL.

  2. Otherwise, return the frozen base URL of the first base element in the Document that has an href attribute, in tree order.

2.4.2 CORS settings attributes

A CORS settings attribute is an enumerated attribute. The following table lists the keywords and states for the attribute — the keywords in the left column map to the states in the cell in the second column on the same row as the keyword.

Keyword State Brief description
anonymous Anonymous Requests for the element will have their mode set to "cors" and their credentials mode set to "same-origin".
use-credentials Use Credentials Requests for the element will have their mode set to "cors" and their credentials mode set to "include".

The empty string is also a valid keyword, and maps to the Anonymous state. The attribute's invalid value default is the Anonymous state. For the purposes of reflection, the canonical case for the Anonymous state is the anonymous keyword. The missing value default, used when the attribute is omitted, is the No CORS state.

2.4.3 Referrer policy attributes

A referrer policy attribute is an enumerated attribute. Each referrer policy, including the empty string, is a keyword for this attribute, mapping to a state of the same name.

The attribute's invalid value default and missing value default are both the empty string state.

The impact of these states on the processing model of various fetches is defined in more detail throughout this specification, in the WHATWG Fetch standard, and in Referrer Policy. [FETCH] [REFERRERPOLICY]

Several signals can contribute to which processing model is used for a given fetch; a referrer policy attribute is only one of them. In general, the order in which these signals are processed are:

  1. First, the presence of a noreferrer link type;

  2. Then, the value of a referrer policy attribute;

  3. Then, the presence of any meta element with name attribute set to referrer.

  4. Finally, the `Referrer-Policy` HTTP header.

2.4.4 Nonce attributes

A nonce content attribute represents a cryptographic nonce ("number used once") which can be used by Content Security Policy to determine whether or not a given fetch will be allowed to proceed. The value is text. [CSP]

Elements that have a nonce content attribute ensure that the crytographic nonce is only exposed to script (and not to side-channels like CSS attribute selectors) by extracting the value from the content attribute, moving it into an internal slot named [[CryptographicNonce]], and exposing it to script via the NoncedElement interface defined below. Unless otherwise specified, the slot's value is the empty string.

element . nonce

Returns the value of the element's [[CryptographicNonce]] internal slot.

Can be set, to update that slot's value.

The nonce IDL attribute must, on getting, return the value of this element's [[CryptographicNonce]]; and on setting, set this element's [[CryptographicNonce]] to the given value.

Whenever a NoncedElement's nonce attribute is set or changed, set this element's [[CryptographicNonce]] to the given value.

Whenever a NoncedElement becomes browsing-context connected, the user agent must executing the following steps on the element:

  1. Let CSP list be element's shadow-including root's CSP list.

  2. If CSP list contains a header-delivered Content Security Policy, and element has a nonce content attribute attr whose value is not the empty string, then:

    1. Set an attribute value for element using "nonce" and the empty string.

As each Document's CSP list is append-only, user agents can optimize away the contains a header-delivered Content Security Policy check by, for example, holding a flag on the Document, set during Document initialization.

The cloning steps for elements that implement NoncedElement must set the [[CryptographicNonce]] slot on the copy to the value of the slot on the element being cloned.