Fetch Metadata

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 76)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/fetch/sec-metadata?label=master&product=chrome%5Bexperimental%5D&product=edge&product=firefox%5Bexperimental%5D&product=safari%5Bexperimental%5D&aligned

Summary

Introduces a new set of HTTP request headers, including `Sec-Fetch-Site`, `Sec-Fetch-Mode` and `Sec-Fetch-User`, that sends additional metadata about a request's provenance (is it cross-site, is it triggered from <img>, etc.) to the server to allow it to make security decisions which might mitigate some kinds of attacks based on timing the server's response (xsleaks and others).

Standards & signals

Specification: https://mikewest.github.io/sec-metadata/
Firefox: No signal — https://github.com/mozilla/standards-positions/issues/88 is ongoing, but I've heard positive things from individuals.
Safari: No signal
Web developers: Positive — Dropbox wants to deploy this https://github.com/w3ctag/design-reviews/issues/280#issuecomment-440896562. Google wants to deploy this. I've heard positive comments from GitHub as well.
Tracking bug: https://bugs.chromium.org/p/chromium/issues/detail?id=843478

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=fetch%2Fsec-metadata
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Fetch%20Metadata
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Fetch%20Metadata
Baseline status: https://webstatus.dev/?q=Fetch%20Metadata

Explainers: https://github.com/mikewest/sec-metadata

View on chromestatus.com