Should allowed have special values besides null

[annevk]

Regarding #66 I think it would be useful if allowed had special values besides null, in particular for resources you don't plan on updating and would not want to invalidate (if ever), but would like to use the latest policy for.

[domenic]

This is equivalent to omitting the header entirely, right?

[annevk]

So https://wicg.github.io/origin-policy/#update-the-origin-policy-from-a-response returns "success" in step 4. The caller seems to do nothing with the return value. How does that ensure the latest policy?

[domenic]

The current cached policy is applied whenever setting up something that would benefit from policies. So e.g. https://wicg.github.io/origin-policy/#monkeypatch-fp and https://wicg.github.io/origin-policy/#monkeypatch-csp so far.

Maybe we should add a note to the "return success" step, something like

In this case any web platform feature that is governed by origin policy will consult the response's URL's origin's origin policy.

[annevk]

So I navigate to A for the first time and A does not specify a header, what makes it download A's origin policy and apply it?

[domenic]

Ah, I see, yes, that use case is not met. OK, adding!

[domenic]

Hmm, so what are the specific semantics we want? I can think of a few:

• "Latest from the cache": performs a cache-enabled fetch to the origin policy URL. If you've never visited the origin before this will indeed fetch the policy. If you have and got a 404, this will return the 404, giving the null policy.

• "Always refetch from network": performs a cache-disabled fetch to the origin policy URL.

• "Cache then network": perform a cache-enabled fetch. If this 404s from the cache, then go to the network.

[annevk]

Is there an equivalent of max-age for cached items? Bypassing the cache altogether seems bad, but the cache does need to support some invalidation probably?

[domenic]

I'm a bit confused. You can just use max-age or etags or similar; it's the HTTP cache.

[annevk]

In that case I would expect a normal request with the request defaults?

[domenic]

So "latest from the cache" in my above list. (Although I recognize now that that was a somewhat misleading name; perhaps "latest, possibly from cache" would make more sense.)