HTML Living Standard — Last Updated

8 Web application APIs

8.1 Scripting

8.1.1 Introduction

Various mechanisms can cause author-provided executable code to run in the context of a document. These mechanisms include, but are probably not limited to:

Processing of script elements.

elements. Navigating to javascript: URLs.

URLs. Event handlers, whether registered through the DOM using addEventListener() , by explicit event handler content attributes, by event handler IDL attributes, or otherwise.

, by explicit event handler content attributes, by event handler IDL attributes, or otherwise. Processing of technologies like SVG that have their own scripting features.

8.1.2 Enabling and disabling scripting

Scripting is enabled in a browsing context when all of the following conditions are true:

Scripting is disabled in a browsing context when any of the above conditions are false (i.e. when scripting is not enabled).

Scripting is enabled for a node if the node's node document has a browsing context, and scripting is enabled in that browsing context.

Scripting is disabled for a node if there is no such browsing context, or if scripting is disabled in that browsing context.

8.1.3 Processing model

8.1.3.1 Definitions

A script is one of two possible structs. All scripts have:

A classic script is a type of script that has the following additional item:

A muted errors boolean A boolean which, if true, means that error information will not be provided for errors in this script. This is used to mute errors for cross-origin scripts, since that can leak private information.

A module script is another type of script. It has no additional items.

The active script is determined by the following algorithm:

Let record be GetActiveScriptOrModule(). If record is null, return null. Return record .[[HostDefined]].

An environment is an object that identifies the settings of a current or potential execution environment. An environment has the following fields:

Specifications may define environment discarding steps for environments. The steps take an environment as input.

The environment discarding steps are run for only a select few environments: the ones that will never become execution ready because, for example, they failed to load.

An environment settings object is an environment that additionally specifies algorithms for:

An environment settings object also has an outstanding rejected promises weak set and an about-to-be-notified rejected promises list , used to track unhandled promise rejections. The outstanding rejected promises weak set must not create strong references to any of its members, and implementations are free to limit its size, e.g. by removing old entries from it when new ones are added.

8.1.3.2 Fetching scripts

This section introduces a number of algorithms for fetching scripts, taking various necessary inputs and resulting in classic or module scripts.

Script fetch options is a struct with the following items:

cryptographic nonce The cryptographic nonce metadata used for the initial fetch and for fetching any imported modules integrity metadata The integrity metadata used for the initial fetch parser metadata The parser metadata used for the initial fetch and for fetching any imported modules credentials mode The credentials mode used for the initial fetch (for module scripts) and for fetching any imported modules (for both module scripts and classic scripts) referrer policy The referrer policy used for the initial fetch and for fetching any imported modules

Recall that via the import() feature, classic scripts can import module scripts.

The default classic script fetch options are a script fetch options whose cryptographic nonce is the empty string, integrity metadata is the empty string, parser metadata is " not-parser-inserted ", credentials mode is " omit ", and referrer policy is the empty string.

Given a request request and a script fetch options options , we define:

For any given script fetch options options , the descendant script fetch options are a new script fetch options whose items all have the same values, except for the integrity metadata, which is instead the empty string.

The algorithms below can be customized by optionally supplying a custom perform the fetch hook, which takes a request and an is top-level flag. The algorithm must complete with a response (which may be a network error), either synchronously (when using fetch a classic worker-imported script) or asynchronously (otherwise). The is top-level flag will be set for all classic script fetches, and for the initial fetch when fetching a module script graph or fetching a module worker script graph, but not for the fetches resulting from import statements encountered throughout the graph.

By default, not supplying the perform the fetch will cause the below algorithms to simply fetch the given request, with algorithm-specific customizations