Add TAO destination check for navigation redirect chains

Timing-Allow-Origin (TAO) currently only opts-in "backwards" in terms of origins and doesn't constitute an opt-in to the destination origin, which is the appropriate opt-in for navigations (contrary to subresources).

This PR adds the mechanisms that can enable such "forward" opt-in, and can enable a navigation response to a redirect chain to know that the redirect chain opted in to expose the redirects to its origin.

Tests: web-platform-tests/wpt#60823 & web-platform-tests/wpt#60873.

Corresponding HTML PR: whatwg/html#12513.

Author: yoavweiss

fetch.bs

@@ -135,6 +135,7 @@ urlPrefix:https://www.rfc-editor.org/rfc/rfc6454;type:dfn;spec:RFC6454
 <pre class=link-defaults>
 spec:dom; type:dfn; text:element
 spec:infra; type:dfn; text:implementation-defined
+spec:infra; type:dfn; text:success
 </pre>
 
 
@@ -2307,10 +2308,19 @@ Unless stated otherwise, it is unset.
 <dfn export for=request id=timing-allow-failed>timing allow failed flag</dfn>. Unless stated
 otherwise, it is unset.
 
+<p>A <a for=/>request</a> has an associated
+<dfn for=request>navigation timing allow values list</dfn> (a <a for=/>list</a> of
+<a for=/>lists</a> of <a for=/>strings</a>). Unless stated otherwise, it is « ».
+
+<p class=note>Each <a for=list>item</a> in the <a for=request>navigation timing allow values list</a>
+holds the `<code>Timing-Allow-Origin</code>` values of one redirect <a for=/>response</a> in a
+navigation's redirect chain.
+
 <p class=note>A <a for=/>request</a>'s <a for=request>URL list</a>, <a for=request>current URL</a>,
 <a for=request>redirect count</a>, <a for=request>response tainting</a>,
-<a for=request>done flag</a>, and <a for=request>timing allow failed flag</a> are used as
-bookkeeping details by the <a for=/>fetch</a> algorithm.
+<a for=request>done flag</a>, <a for=request>timing allow failed flag</a>, and
+<a for=request>navigation timing allow values list</a> are used as bookkeeping details by the
+<a for=/>fetch</a> algorithm.
 
 <p>A <a for=/>request</a> has an associated
 <dfn export for=request id=concept-webdriver-id>WebDriver id</dfn>
@@ -2608,6 +2618,15 @@ allowed on the resource fetched by looking at the flag of the response returned.
 the response of a redirect has to be set if it was set for previous responses in the redirect chain,
 this is also tracked internally using the request's <a for=request>timing allow failed flag</a>.
 
+<p>A <a for=/>response</a> has an associated
+<dfn export for=response>navigation timing allow values list</dfn> (a <a for=/>list</a> of
+<a for=/>lists</a> of <a for=/>strings</a>). Unless stated otherwise, it is « ».
+
+<p class=note>This holds the `<code>Timing-Allow-Origin</code>` values of each redirect
+<a for=/>response</a> in a navigation's redirect chain. It is used so that callers can determine,
+once the navigation's destination origin is known, whether that origin is allowed by every redirect
+in the redirect chain.
+
 <p>A <a for=/>response</a> has an associated
 <dfn export for=response id=concept-response-body-info>body info</dfn>
 (a <a for=/>response body info</a>). Unless stated otherwise, it is a new
@@ -5104,6 +5123,11 @@ steps:
  <li><p>Set <var>internalResponse</var>'s <a for=response>redirect taint</a> to <var>request</var>'s
  <a for=request>redirect-taint</a>.
 
+ <li><p>If <var>request</var> is a <a>navigation request</a>, then set
+ <var>internalResponse</var>'s <a for=response>navigation timing allow values list</a> to a
+ <a for=list>clone</a> of <var>request</var>'s
+ <a for=request>navigation timing allow values list</a>.
+
  <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is unset, then set
  <var>internalResponse</var>'s <a for=response>timing allow passed flag</a>.
 
@@ -5884,6 +5908,10 @@ these steps:
   <p>If <var>internalResponse</var>'s <a for=response>status</a> is a <a>redirect status</a>:
 
   <ol>
+   <li><p>If <var>request</var> is a <a>navigation request</a>, then
+   <a>append to a request's navigation timing allow values list</a> given <var>request</var> and
+   <var>internalResponse</var>.
+
    <li>
     <p>If <var>internalResponse</var>'s <a for=response>status</a> is not 303, <var>request</var>'s
     <a for=request>body</a> is non-null, and the <a>connection</a> uses HTTP/2, then user agents
@@ -7311,6 +7339,48 @@ agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a
 </ol>
 </div>
 
+<div algorithm>
+<p>To <dfn>append to a request's navigation timing allow values list</dfn>, given a
+<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>:
+
+<ol>
+ <li><p><a for=/>Assert</a>: <var>request</var> is a <a>navigation request</a>.
+
+ <li><p>Let <var>taoValues</var> be the result of
+ <a for="header list">getting, decoding, and splitting</a> `<code>Timing-Allow-Origin</code>` from
+ <var>response</var>'s <a for=response>header list</a>.
+
+ <li><p>If <var>taoValues</var> is null, then set <var>taoValues</var> to « ».
+
+ <li><p><a for=list>Append</a> <var>taoValues</var> to <var>request</var>'s
+ <a for=request>navigation timing allow values list</a>.
+</ol>
+</div>
+
+<div algorithm>
+<p>To perform a <dfn export>navigation TAO check</dfn> for a
+<a for=/>response</a> <var>response</var> and an <a for=/>origin</a>
+<var>destinationOrigin</var>:
+
+<ol>
+ <li>
+  <p><a for=list>For each</a> <var>taoValues</var> of <var>response</var>'s
+  <a for=response>navigation timing allow values list</a>:
+
+  <ol>
+   <li><p>If <var>taoValues</var> <a for=list>contains</a> "<code>*</code>", then
+   <a for=iteration>continue</a>.
+
+   <li><p>If <var>taoValues</var> <a for=list>contains</a> <var>destinationOrigin</var>,
+   <a lt="ASCII serialization of an origin">serialized</a>, then <a for=iteration>continue</a>.
+
+   <li><p>Return <a for=/>failure</a>.
+  </ol>
+
+ <li><p>Return <a for=/>success</a>.
+</ol>
+</div>
+
 <h3 id=deferred-fetch>Deferred fetching</h3>
 
 <p>Deferred fetching allows callers to request that a fetch is invoked at the latest possible