net: Set "request-includes-credentials" and URL list of response for "HTTP-network-or-cache fetch" by yezhizhen · Pull Request #43798 · servo/servo

yezhizhen · 2026-03-31T12:58:56Z

Implement step 11, 13 of HTTP-network-or-cache fetch

Testing: The value should be used in https://fetch.spec.whatwg.org/#cross-origin-resource-policy-internal-check, which will be done in a follow up. Right now it is not used.

Signed-off-by: Euclid Ye <[email protected]>

github-actions · 2026-03-31T13:09:49Z

🔨 Triggering try run (#23799012352) for Linux (WPT)

github-actions · 2026-03-31T13:39:42Z

Test results for linux-wpt from try job (#23799012352):

Flaky unexpected result (33)

OK /FileAPI/url/url-with-fetch.any.worker.html (#21517)
- FAIL [expected PASS] subtest: Revoke blob URL after calling fetch, fetch should succeed
```
promise_test: Unhandled rejection with value: object "TypeError: Network error: Blob URL store error: InvalidFileID"
```
OK /_mozilla/mozilla/getBoundingClientRect.html (#39668)
- FAIL [expected PASS] subtest: getBoundingClientRect 1
```
assert_equals: expected 62 but got 60.35
```
CRASH [expected OK] /content-security-policy/meta/sandbox-iframe.html (#43478)
FAIL [expected PASS] /css/css-backgrounds/border-image-repeat-space-9.html
OK /css/css-cascade/layer-cssom-order-reverse.html (#36094)
- FAIL [expected PASS] subtest: Delete layer invalidates @font-face
```
assert_equals: expected "220px" but got "133px"
```
OK /css/css-shadow/font-face-007.html
- FAIL [expected PASS] subtest: @font-face from shadow applies to :host
```
assert_equals: expected 160 but got 100
```
TIMEOUT [expected OK] /fetch/api/redirect/redirect-keepalive.https.any.html (#32153)
- TIMEOUT [expected PASS] subtest: [keepalive][iframe][load] mixed content redirect; setting up
```
Test timed out
```
OK /fetch/content-length/api-and-duplicate-headers.any.worker.html (#35197)
- FAIL [expected PASS] subtest: fetch() and duplicate Content-Length/Content-Type headers
```
promise_test: Unhandled rejection with value: object "TypeError: Network error: HTTP failure: client error (SendRequest)"
```
ERROR [expected OK] /fetch/fetch-later/quota/same-origin-iframe/accumulated-oversized-payload.https.window.html (#41705)
OK [expected ERROR] /fetch/fetch-later/quota/same-origin-iframe/multiple-iframes.https.window.html (#35176)
OK [expected ERROR] /fetch/fetch-later/quota/same-origin-iframe/sandboxed-iframe.https.window.html (#41704)
ERROR /fetch/metadata/generated/serviceworker.https.sub.html (#36247)
- PASS [expected FAIL] subtest: sec-fetch-site - Same origin, no options - registration
OK /html/browsers/browsing-the-web/navigating-across-documents/navigation-unload-same-origin-fragment.html (#20768)
- PASS [expected FAIL] subtest: Tests that a fragment navigation in the unload handler will not block the initial navigation

OK /html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/a-click.html (#28697)

FAIL [expected PASS] subtest: aElement.click() before the load event must NOT replace

assert_equals: expected "http://web-platform.test:8000/common/blank.html?thereplacement" but got "http://web-platform.test:8000/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/resources/code-injector.html?pipe=sub(none)&amp;code=%0A%20%20%20%20const%20a%20%3D%20document.createElement(%22a%22)%3B%0A%20%20%20%20a.href%20%3D%20%22%2Fcommon%2Fblank.html%3Fthereplacement%22%3B%0A%20%20%20%20document.currentScript.before(a)%3B%0A%20%20%20%20a.click()%3B%0A%20%20"

CRASH [expected OK] /html/browsers/browsing-the-web/unloading-documents/beforeunload-on-history-back.html
OK /html/browsers/history/the-history-interface/traverse_the_history_3.html (#21383)
- PASS [expected FAIL] subtest: Multiple history traversals, last would be aborted
CRASH [expected OK] /html/canvas/element/canvas-host/2d.canvas.host.size.attributes.setAttribute.whitespace.html
TIMEOUT /html/interaction/focus/the-autofocus-attribute/supported-elements.html (#24145)
- PASS [expected TIMEOUT] subtest: Non-HTMLElement should not support autofocus
- FAIL [expected NOTRUN] subtest: Host element with delegatesFocus should support autofocus
```
assert_equals: expected Element node &lt;div autofocus=""&gt;&lt;/div&gt; but got Element node &lt;body&gt;&lt;div autofocus=""&gt;&lt;/div&gt;&lt;/body&gt;
```
- TIMEOUT [expected NOTRUN] subtest: Host element with delegatesFocus including no focusable descendants should be skipped
```
Test timed out
```
TIMEOUT [expected OK] /html/semantics/embedded-content/the-iframe-element/iframe_sandbox_navigate_other_frame_popup.sub.html (#39702)
- TIMEOUT [expected FAIL] subtest: Sandboxed iframe can not navigate other frame's popup
```
Test timed out
```
TIMEOUT [expected OK] /html/semantics/forms/form-submission-0/form-submit-iframe-then-location-navigate.html (#29634)
- TIMEOUT [expected FAIL] subtest: Verifies that location navigations take precedence when following form submissions.
```
Test timed out
```
OK /html/semantics/forms/form-submission-0/jsurl-form-submit.tentative.html (#36489)
- PASS [expected FAIL] subtest: Verifies that form submissions scheduled inside javascript: urls take precedence over the javascript: url's return value.
PASS [expected FAIL] /png/apng/acTL-plays-two.html (#41191)
OK /preload/prefetch-document.html (#37210)
- FAIL [expected PASS] subtest: different-site document prefetch with 'as=document' should not be consumed
```
assert_equals: expected 2 but got 1
```
OK /resource-timing/test_resource_timing.https.html (#25216)
- PASS [expected FAIL] subtest: PerformanceEntry has correct name, initiatorType, startTime, and duration (xmlhttprequest)
OK [expected TIMEOUT] /trusted-types/trusted-types-navigation.html?06-10 (#37920)
- PASS [expected FAIL] subtest: Navigate a frame via anchor with javascript:-urls in report-only mode.
- PASS [expected TIMEOUT] subtest: Navigate a frame via anchor with javascript:-urls w/ default policy in report-only mode.
- FAIL [expected NOTRUN] subtest: Navigate a window via anchor with javascript:-urls w/ a default policy throwing an exception in enforcing mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
- FAIL [expected NOTRUN] subtest: Navigate a window via anchor with javascript:-urls w/ a default policy throwing an exception in report-only mode.
```
promise_test: Unhandled rejection with value: "Unexpected message received: \"No securitypolicyviolation reported!\""
```
CRASH [expected OK] /webaudio/the-audio-api/the-mediastreamaudiodestinationnode-interface/closed-audiocontext-construction.html
OK /webdriver/tests/classic/delete_all_cookies/user_prompts.py
- FAIL [expected PASS] subtest: test_accept[alert-None]
```
webdriver.error.NoSuchWindowException: no such window (404): No such window
```
OK /webdriver/tests/classic/execute_script/objects.py
- FAIL [expected PASS] subtest: test_object
```
AssertionError: no such window (404): No such window
```
OK /webdriver/tests/classic/execute_script/promise.py
- FAIL [expected PASS] subtest: test_promise_resolve
```
AssertionError: no such window (404): No such window
```
OK /webdriver/tests/classic/execute_script/window.py
- FAIL [expected PASS] subtest: test_web_reference[frame]
```
AssertionError: no such window (404): No such window
```
OK /webdriver/tests/classic/get_title/iframe.py
- FAIL [expected PASS] subtest: test_no_iframe
```
AssertionError: no such window (404)
```
OK /webdriver/tests/classic/navigate_to/user_prompts.py
- FAIL [expected PASS] subtest: test_accept[alert]
```
webdriver.error.NoSuchWindowException: no such window (404): No such window
```
OK /webxr/xrSession_features_deviceSupport.https.html (#24357)
- FAIL [expected PASS] subtest: Immersive XRSession requests with no supported device should reject
```
assert_unreached: Should have rejected: undefined Reached unreachable code
```

Stable unexpected results that are known to be intermittent (19)

OK /IndexedDB/idbdatabase_deleteObjectStore.any.worker.html (#43776)
- PASS [expected FAIL] subtest: Deleted object store's name should be removed from database's list. Attempting to use a deleted IDBObjectStore should throw an InvalidStateError
FAIL [expected PASS] /_mozilla/mozilla/sslfail.html (#10760)
TIMEOUT [expected OK] /_mozilla/mozilla/window_resize_event.html (#36741)
- TIMEOUT [expected PASS] subtest: Popup onresize event fires after resizeTo
```
Test timed out
```
OK /_webgl/conformance/textures/misc/texture-upload-size.html (#21770)
- PASS [expected FAIL] subtest: WebGL test #93
- PASS [expected FAIL] subtest: WebGL test #95
- PASS [expected FAIL] subtest: WebGL test #97
- PASS [expected FAIL] subtest: WebGL test #99
- FAIL [expected PASS] subtest: WebGL test #101
```
assert_true: Texture was smaller than the expected size 2x2 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #103
```
assert_true: getError expected: INVALID_VALUE. Was NO_ERROR : when calling texSubImage2D with the same texture upload with offset 1, 1 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #105
```
assert_true: Texture was smaller than the expected size 2x2 expected true got false
```
- FAIL [expected PASS] subtest: WebGL test #107
```
assert_true: getError expected: INVALID_VALUE. Was NO_ERROR : when calling texSubImage2D with the same texture upload with offset 1, 1 expected true got false
```
- PASS [expected FAIL] subtest: WebGL test #109
- PASS [expected FAIL] subtest: WebGL test #111
- And 14 more unexpected results...
OK /css/css-fonts/generic-family-keywords-001.html (#37467)
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(kai)
```
assert_equals: quoted generic(kai) matches  @font-face rule expected 30 but got 50
```
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(khmer-mul)
```
assert_equals: quoted generic(khmer-mul) matches  @font-face rule expected 30 but got 50
```
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(nastaliq)
```
assert_equals: quoted generic(nastaliq) matches  @font-face rule expected 30 but got 50
```
OK /css/css-fonts/generic-family-keywords-003.html (#38994)
- FAIL [expected PASS] subtest: @font-face matching for quoted and unquoted generic(nastaliq) (drawing text in a canvas)
```
assert_equals: quoted generic(nastaliq) matches  @font-face rule expected 125 but got 40
```
OK /fetch/metadata/generated/css-font-face.https.sub.tentative.html (#32732)
- PASS [expected FAIL] subtest: sec-fetch-dest
OK /fetch/metadata/generated/css-font-face.sub.tentative.html (#34624)
- PASS [expected FAIL] subtest: sec-fetch-storage-access - Not sent to non-trustworthy same-site destination
OK /fetch/metadata/generated/element-iframe.https.sub.html (#40341)
- PASS [expected FAIL] subtest: sec-fetch-site - Cross-site
- PASS [expected FAIL] subtest: sec-fetch-site - Same site
- PASS [expected FAIL] subtest: sec-fetch-site - Cross-Site -> Cross-Site
- PASS [expected FAIL] subtest: sec-fetch-site - Same-Site -> Same-Site
OK /fetch/metadata/window-open.https.sub.html (#40339)
- FAIL [expected PASS] subtest: Same-site window, forced, reloaded
```
The operation is insecure.
```
- PASS [expected FAIL] subtest: Same-site window, forced, reloaded: sec-fetch-site
- PASS [expected FAIL] subtest: Cross-site window, forced: sec-fetch-site
- PASS [expected FAIL] subtest: Cross-site window, forced, reloaded: sec-fetch-site
- PASS [expected FAIL] subtest: Same-site window, forced: sec-fetch-site
- PASS [expected FAIL] subtest: Same-site window, user-activated: sec-fetch-site
- PASS [expected FAIL] subtest: Cross-site window, user-activated: sec-fetch-site
OK /html/browsers/browsing-the-web/navigating-across-documents/navigation-unload-same-origin.window.html (#29049)
- PASS [expected FAIL] subtest: Same-origin navigation started from unload handler must be ignored
CRASH [expected TIMEOUT] /html/browsers/history/the-location-interface/location_replace_session_history.html (#41896)
OK /html/semantics/embedded-content/media-elements/audio_loop_seek_to_eos.html (#41226)
- PASS [expected FAIL] subtest: seeking to the end of looping audio
OK /html/webappapis/dynamic-markup-insertion/document-write/iframe_005.html (#43671)
- FAIL [expected PASS] subtest: document.write external script into iframe write back into parent
```
assert_array_equals: lengths differ, expected array [1, 2, 3, 4, 5] length 5, got [1, 2] length 2
```
PASS [expected FAIL] /png/apng/fcTL-dispose-none.html (#41817)
OK /touch-events/single-tap-when-touchend-listener-use-sync-xhr.html (#41175)
- FAIL [expected PASS] subtest: Click event should be fired when touchend opens synchronous XHR
```
assert_equals: expected "touchend@div, mousedown@div, mouseup@div, click@div" but got "touchend@div"
```
OK /trusted-types/trusted-types-reporting.html (#43737)
- PASS [expected FAIL] subtest: Trusted Type violation report: creating a forbidden-but-not-reported policy.
- PASS [expected FAIL] subtest: Trusted Type violation report: sample for SVGScriptElement href assignment by setAttribute
- FAIL [expected PASS] subtest: Trusted Type violation report: sample for custom element assignment
```
assert_equals: a single violation reported expected 1 but got 2
```
OK [expected TIMEOUT] /webmessaging/with-ports/018.html (#24485)
- PASS [expected TIMEOUT] subtest: origin of the script that invoked the method, javascript:
OK [expected TIMEOUT] /webmessaging/without-ports/018.html (#24485)
- PASS [expected TIMEOUT] subtest: origin of the script that invoked the method, javascript:

github-actions · 2026-03-31T13:39:51Z

✨ Try run (#23799012352) succeeded.

yezhizhen · 2026-03-31T14:32:11Z

Ah, I think this is expected. We haven't actually used the value yet. It requires a follow up.

yezhizhen · 2026-04-01T04:17:24Z

Ah, I think this is expected. We haven't actually used the value yet. It requires a follow up.

Well, I also tried to do this directly instead of in a follow-up. But it seems we need a rewrite..
Spec is right now very different

servo/components/net/http_loader.rs

Lines 2014 to 2016 in c4d32e1

    
           // TODO(#33615): Judging from the name, this appears to be https://fetch.spec.whatwg.org/#cross-origin-resource-policy-check, 
        
           //       but the steps aren't even close to the spec. Perhaps this needs to be rewritten? 
        
           fn cross_origin_resource_policy_check(

TimvdLippe

Typically we don't implement these things until we also use them. I see you already tried to do so and wasn't able to, so I am okay with merging as-is. But do try to find the relevant usage and make use of the value.

Most notably, implement step 5 and removes the incorrect place for it. Part of follow up to #43798 Testing: [Try](https://github.com/yezhizhen/servo/actions/runs/24021988217/job/70054752138) --------- Signed-off-by: Euclid Ye <[email protected]>

servo-highfive added the S-awaiting-review There is new code that needs to be reviewed. label Mar 31, 2026

yezhizhen marked this pull request as draft March 31, 2026 13:03

.

3e7716a

Signed-off-by: Euclid Ye <[email protected]>

yezhizhen force-pushed the load branch from d85264d to 3e7716a Compare March 31, 2026 13:09

yezhizhen added the T-linux-wpt Do a try run of the WPT label Mar 31, 2026

github-actions Bot removed the T-linux-wpt Do a try run of the WPT label Mar 31, 2026

yezhizhen marked this pull request as ready for review March 31, 2026 13:10

yezhizhen requested a review from TimvdLippe April 3, 2026 00:34

TimvdLippe approved these changes Apr 3, 2026

View reviewed changes

servo-highfive removed the S-awaiting-review There is new code that needs to be reviewed. label Apr 3, 2026

TimvdLippe added this pull request to the merge queue Apr 3, 2026

servo-highfive added the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Apr 3, 2026

Merged via the queue into servo:main with commit b47ab9c Apr 3, 2026
69 checks passed

servo-highfive removed the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Apr 3, 2026

yezhizhen deleted the load branch April 3, 2026 08:47

yezhizhen mentioned this pull request Apr 6, 2026

net: Improve HTTP fetch compliance #43970

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

net: Set "request-includes-credentials" and URL list of response for "HTTP-network-or-cache fetch"#43798

net: Set "request-includes-credentials" and URL list of response for "HTTP-network-or-cache fetch"#43798
TimvdLippe merged 1 commit into
servo:mainfrom
yezhizhen:load

yezhizhen commented Mar 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

yezhizhen commented Mar 31, 2026

Uh oh!

yezhizhen commented Apr 1, 2026 •

edited

Loading

Uh oh!

TimvdLippe left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

yezhizhen commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

yezhizhen commented Mar 31, 2026

Uh oh!

yezhizhen commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TimvdLippe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

yezhizhen commented Mar 31, 2026 •

edited

Loading

yezhizhen commented Apr 1, 2026 •

edited

Loading