- Security Considerations {#security-considerations}
- ==================================================
-
-
- We should expand this section further.
-
-
- Overview {#security-overview}
- -----------------------------
-
- *This section is non-normative.*
-
- In general, a [=portal browsing context=] should respect policies that would apply to
- a [=nested browsing context=], e.g. that would restrict whether a document can be embedded
- in a document from another [=origin=].
+ Updates to other specifications {#other-spec-updates}
+ =====================================================
- Integration with Content Security Policy {#csp}
- -----------------------------------------------
+ Content Security Policy {#csp}
+ ------------------------------
This specification integrates with [[CSP]] as follows.
@@ -913,10 +944,14 @@ spec:url; type:dfn; text:scheme
{{HTMLPortalElement/activate(options)}} should also respect the CSP [=navigate-to=] directive.
- Integration with RFC 7034 {#rfc7034}
- ------------------------------------
+ RFC 7034 {#rfc7034}
+ -------------------
- This specification integrates with [[RFC7034]], which defines the `X-Frame-Options` HTTP header, as follows.
+ This specification integrates with [[RFC7034]], which defines the `X-Frame-Options` HTTP header,
+ as follows. Note that [[HTML]] also has an open issue,
+ whatwg/html#1230, to define
+ `X-Frame-Options` processing, and perhaps these updates would be done as part of resolving that
+ issue.
If a browser receives content with this header field in response to a navigation request whose
[=target browsing context=] is a [=portal browsing context=], then the browser must apply the rules
@@ -930,11 +965,20 @@ spec:url; type:dfn; text:scheme
1. Return |topLevelBrowsingContext|.
- Integration with Fetch Metadata Request Headers {#fetch-metadata}
- -----------------------------------------------------------------
+ Fetch Metadata Request Headers {#fetch-metadata}
+ ------------------------------------------------
This specification integrates with [[FETCH-METADATA]] as follows.
+
+ The algorithm to [[FETCH-METADATA#abstract-opdef-set-mode|set the Sec-Fetch-Mode header]] for a request |r|
+ is modified as follows:
+
+ 1. Where the algorithm checks whether |r|'s [=reserved client=]'s [=target browsing context=] is
+ a [=nested browsing context=], check instead whether it is a [=nested browsing context=] or
+ a [=portal browsing context=].
+
+
The effect of this is that the request for a document in a [=portal browsing context=]
will contain the following HTTP header, as though it were in a [=nested browsing context=].
@@ -942,19 +986,31 @@ spec:url; type:dfn; text:scheme
```
Sec-Fetch-Mode: nested-navigate
```
+
- Even though no spec patches are required to do so, implementations must also send
- the appropriate fetch metadata headers as it would if the load were occurring in
- an <{iframe}> element.
+
+ Per the existing processing model, the other fetch metadata headers will automatically have the
+ same values as they would would if the load were occurring in an <{iframe}> element, with no
+ spec updates needed.
+
-