Speculation Rules

Modify parse a map , then return null. Let result be an empty speculation rule set . Let tag be null. string as follows:

• If Remove the parsed typesToTreatAsPrefetch [" tag "] exists , then: If construct, and instead parse parsed [" tag prerender "] is not into the prerender rules list, in an ASCII string , then return null. If identical manner to what is done for parsed [" tag prefetch "] contains any code points that are not in and the range U+0020 to U+007E inclusive, then return null. prefetch rules .

• Set tag to Discard rules parsed [" tag "]. If from parsed [" prefetch "] exists and is a list , then for each prefetchRule of parsed [" prefetch "]: If prefetchRule is not a map , then continue . Let rule be if the result of parsing a speculation rule given prefetchRule , tag , document and baseURL . If rule is null, then continue . If rule ’s target navigable name hint is not null, then continue . Append rule to result ’s prefetch rules . If parsed [" prerender "] exists and is a list , then for each prerenderRule of parsed [" prerender "]: If prerenderRule is not a map , then continue . null.

  Let rule

Implementations will still be the result of parsing a speculation rule given prerenderRule , tag , document , and baseURL . If rule is null, then continue . Append rule allowed to result ’s treat prerender rules candidates as prefetches, per the modifications in § 3 Processing model .

Return result .

To Modify parse a speculation rule given a map input , a speculation rules tag rulesetLevelTag , a document document , and a URL baseURL , perform by adding the following steps. They return a speculation rule or null. If input has any key other than " source ", " urls ", " where ", " requires ", " target_hint "," referrer_policy ", " relative_to ", " eagerness ", " expects_no_vary_search ", or " tag ", then return null. Let source be null. If input [" source "] exists, then: Set source to input [" source "]. Otherwise, if input [" urls "] exists and input [" where "] does not exist , then: Set source to " list ". Otherwise, if input [" where "] exists and input [" urls "] does not exist , then: Set source to " document ". If source is neither the string " list " nor the string " document ", then return null. Let urls be an empty list . Let predicate be null. If source is " list ": If input [" where "] exists , then return null. If input [" urls "] does not exist , is not a list , or has any element which is not a string , then return null. If input [" relative_to "] exists : Let relativeTo be input [" relative_to "]. If relativeTo is neither the string " ruleset " nor the string " document ", then return null. If relativeTo is " document ", then set baseURL to the document ’s document base URL . For each urlString of input [" urls "]: Let parsedURL be the result of parsing urlString with baseURL . If parsedURL is failure, then continue . If parsedURL ’s scheme is not an HTTP(S) scheme , then continue . Append parsedURL to urls . If source is " document ": If input [" urls "] exists , then return null. If input [" relative_to "] exists , then return null. If input [" where "] does not exist , then set predicate to a document rule conjunction whose clauses is an empty list . Such a predicate will match all links. Otherwise, set predicate to the result of parsing a document rule predicate given input [" where "], document and baseURL . If predicate is null, then return null. Let requirements be an empty ordered set . If input [" requires "] exists , but is not a list , then return null. For each requirement of input [" requires "]: steps:

1. If requirement is not the string " anonymous-client-ip-when-cross-origin ", then return null. Append requirement to requirements . Let targetHint be null.

2. If input [" target_hint "] exists :

   1. If input [" target_hint "] is not a valid navigable target name or keyword , then return null. Set targetHint to input [" target_hint "]. Let referrerPolicy be the empty string. If input [" referrer_policy "] exists :

      1. If input [" referrer_policy "] is not The user agent may report a referrer policy , then return null. Set referrerPolicy warning to input [" referrer_policy "]. Let eagerness be " immediate " if source is " list ", and " conservative " otherwise. If input [" eagerness "] exists : If input [" eagerness "] is not one of the valid eagerness strings , then return null. Set eagerness to input [" eagerness "]. Let noVarySearchHint be console indicating that the default URL search variance . If input [" expects_no_vary_search "] exists : supplied target hint was invalid.

      2. If input [" expects_no_vary_search "] is not a string , then return Return null.

   2. Set noVarySearchHint targetHint to the result of obtaining a URL search variance given input [" expects_no_vary_search target_hint "].

   Let tags be an empty ordered set . If rulesetLevelTag is not null, then append rulesetLevelTag to tags . If input [" tag "] exists : If input [" tag "] is not an ASCII string , then return null. Append input [" tag "] to tags .

If tags is empty, and then append null to tags . Assert : tags ’s size is either 1 or 2. Return updating the final step which returns a speculation rule with tags tags URLs urls predicate predicate requirements requirements to include setting the target navigable name hint targetHint referrer policy referrerPolicy eagerness eagerness No-Vary-Search hint noVarySearchHint To parse a document rule predicate given a value input , a document document and URL baseURL : If input is not a map , then return null. If input does not contain exactly one of " and ", " or ", " not ", " href_matches " and " selector_matches ", then return null. Otherwise, let predicateType be that key. This makes sure it is unambiguous what type of predicate is being used. If predicateType is " and " or " or ", then: If input has any key other than predicateType , then return null. This, and other similar checks below, make sure that unexpected extra options cause the predicate to be invalid. Let rawClauses be the input [ predicateType ]. If rawClauses is not a list , then return null. Let clauses be an empty list . For each rawClause of rawClauses : Let clause be the result of parsing a document rule predicate given rawClause , document and baseURL . If clause is null, then return null. Append clause to clauses . If predicateType is " and ", then return a document rule conjunction whose clauses is clauses . If predicateType is " or ", then return a document rule disjunction whose clauses is clauses . If predicateType is " not ", then: If input has any key other than " not ", then return null. Let rawClause be the input [ predicateType ]. Let clause be the result of parsing a document rule predicate given rawClause , document and baseURL . If clause is null, then return null. Return a document rule negation whose clause is clause . If predicateType is " href_matches ": If input has any key other than " href_matches " and " relative_to ", then return null. If input [" relative_to "] exists , then: Let relativeTo be input [" relative_to "]. If relativeTo is neither the string " ruleset " nor the string " document ", then return null. If relativeTo is " document ", set baseURL to the document ’s document base URL . Let rawPatterns be input [" href_matches "]. If rawPatterns is not a list , then set rawPatterns to « rawPatterns ». Let patterns be an empty list . For each rawPattern of rawPatterns : Let pattern be the result of building a URL pattern from an Infra value rawPattern given baseURL . If this step throws, catch the exception and return null. Append pattern to patterns . Return a document rule URL pattern predicate whose patterns is patterns . If predicateType is " selector_matches ": If input has any key other than " selector_matches ", then return null. Let rawSelectors be input [" selector_matches "]. If rawSelectors is not a list , then set rawSelectors to « rawSelectors ». Let selectors be an empty list . For each rawSelector of selectors : If rawSelector is not a string , then return null. Parse a selector from rawSelector . If the result is failure, then return null. Otherwise, let selector be the result. Append selector to selectors . Return a document rule CSS selector predicate whose selectors is selectors targetHint .

Update the referrer policy computation in following a hyperlink . To inner consider speculation for a document document : If document ’s node navigable is not a top-level traversable , then return. Supporting speculative loads in child navigables has some complexities and is not currently defined. It might be possible to define in the future. If document ’s node navigable is a prerendering navigable , then return. Speculative loads in prerendering navigables would be too potentially wasteful. Queue a microtask steps that runs algorithm by appending the following steps given near the beginning, after assembling document prefetchCandidates :

1. If document is not fully active , then return. It’s likely that we should also handle prerendered documents. Let prefetchCandidates be an empty list . Let prerenderCandidates be an empty list .

2. For each ruleSet of document ’s list of speculation rule sets :

   1. For each rule of ruleSet ’s prefetch prerender rules :

      1. Let anonymizationPolicy be null. If rule ’s requirements contains " anonymous-client-ip-when-cross-origin ", set anonymizationPolicy to a cross-origin prefetch IP anonymization policy whose origin is document ’s origin . For each url of rule ’s URLs :

         1. Let referrerPolicy be the result of computing a speculative action load referrer policy given rule and null.

         2. Append a prefetch new prerender candidate with

            tags rule ’s tags URL

            url

            anonymization policy anonymizationPolicy referrer policy referrerPolicy eagerness rule ’s eagerness No-Vary-Search hint

            rule ’s No-Vary-Search hint

            to prefetchCandidates . If rule ’s predicate is not null, then: Let links be the result of finding matching links given document and rule ’s predicate . For each link of links : Let url be link ’s url . Let referrerPolicy be the result of computing a speculative action referrer policy given rule and link . Append a prefetch candidate with tags rule ’s tags URL url anonymization policy anonymizationPolicy referrer policy referrerPolicy

            eagerness

            rule ’s eagerness

            No-Vary-Search hint referrer policy

            rule ’s No-Vary-Search hint to prefetchCandidates . For each rule of ruleSet ’s prerender rules : For each url of rule ’s URLs : Let referrerPolicy be the result of computing a speculative action referrer policy given rule and null. Append a prerender candidate with

            tags

            rule ’s tags

            URL url target navigable name hint

            rule ’s target navigable name hint

            referrer policy referrerPolicy eagerness rule ’s eagerness No-Vary-Search hint rule ’s No-Vary-Search hint

            to prerenderCandidates .

      2. If rule ’s predicate is not null, then:

         1. Let links be the result of finding matching links given document and rule ’s predicate .

         2. For each link of links :

            1. Let url be the link ’s url . Let target be rule ’s target navigable name hint .

            2. If target is null, set it to the result of getting an element’s target given link .

            3. Let referrerPolicy be the result of computing a speculative action load referrer policy given rule and link .

            4. Append a prerender candidate with

               tags URL

               rule link ’s tags url

               URL No-Vary-Search hint

               url rule ’s No-Vary-Search hint

               target navigable name hint eagerness

               target rule ’s eagerness

               referrer policy

               referrerPolicy

               eagerness tags

               rule ’s eagerness tags

               No-Vary-Search target navigable name hint

               rule target ’s No-Vary-Search hint

               to prerenderCandidates .

3. Let speculativeLoadCandidates be the union of prefetchCandidates and prerenderCandidates .

For each prefetchRecord of document ’s Update subsequent steps for canceling not-still-being-speculated prefetch records : If prefetchRecord ’s label is not " speculation-rules ", then continue . Assert : to operate on prefetchRecord speculativeLoadCandidates ’s state is not " canceled ". instead of prefetchCandidates .

If prefetchRecord is not still being speculated given speculativeLoadCandidates , then cancel and discard Replace the step which performs the actual prefetching by looping over prefetchRecord prefetchCandidates given document . with the following:

1. For each prefetchCandidate candidate of prefetchCandidates speculativeLoadCandidates :

   1. The user agent may run the following steps:

      1. Let prefetchAndPrerenderCandidates tagCandidates be an empty list . Extend prefetchAndPrerenderCandidates with prefetchCandidates speculativeLoadCandidates .

      2. Extend If prefetchAndPrerenderCandidates candidate with is a prerender candidate , then set tagCandidates to prerenderCandidates .

      3. Let tagsToSend be the result of collecting tags for matching speculative load candidates given prefetchCandidate candidate and prefetchAndPrerenderCandidates tagCandidates .

      4. Let prefetchRecord be a new prefetch record with

         tags source

         tagsToSend " speculation rules "

         URL

         prefetchCandidate candidate ’s URL

         anonymization policy No-Vary-Search hint

         prefetchCandidate candidate ’s anonymization policy No-Vary-Search hint

         referrer policy

         prefetchCandidate candidate ’s referrer policy

         No-Vary-Search hint tags

         prefetchCandidate tagsToSend ’s No-Vary-Search hint label " speculation-rules "

      5. Prefetch given If document candidate and is a prefetch candidate , then set prefetchRecord . For each ’s anonymization policy to prerenderCandidate candidate of prerenderCandidates : ’s anonymization policy .

      6. The If candidate is a prerender candidate , then the user agent may run the following steps:

         1. Let tagsToSend be the result of collecting tags for matching speculative load candidates given prerenderCandidate and prerenderCandidates . Let Set prefetchRecord be a new prefetch record with tags tagsToSend URL prerenderCandidate ’s URL anonymization policy null referrer policy prerenderCandidate ’s referrer policy No-Vary-Search hint prerenderCandidate ’s No-Vary-Search hint label " speculation-rules " prerendering traversable to " to be created "

         2. Set prefetchRecord ’s prerendering target navigable name hint to prerenderCandidate candidate ’s target navigable name hint .

         3. Start a referrer-initiated prerendering navigational prerender given document and prefetchRecord .

         When deciding whether to execute the "may" steps above that enact from among prefetchCandidates and prerenderCandidates , user agents should consider their eagerness , in accordance with the following: " immediate " The author believes this is very likely to be worthwhile, and might also expect it to require significant lead time to complete. User agents should usually enact the candidate as soon as practical, subject only to considerations such as user preferences, device conditions, and resource limits. " eager " User agents should enact the candidate on even a slight suggestion that the user may navigate to this URL in the future. For instance, the user might have moved the cursor toward a link or hovered it, even momentarily, or paused scrolling when the link is one of the more prominent ones in the viewport. The author is seeking to capture as many navigations as possible, as early as possible. " moderate " User agents should enact the candidate if user behavior suggests the user may navigate to this URL in the near future. For instance, the user might have scrolled a link into the viewport and moved the cursor over it for some time. The author is seeking a balance between " eager " and " conservative ". " conservative " User agents should enact the candidate only when the user is very likely to navigate to this URL at any moment. For instance, the user might have begun to interact with a link. The author is seeking to capture some of the benefits of speculative loading with a fairly small tradeoff of resources.

      7. If a user agent chooses to enact a candidate A , then the user agent should also enact other candidates which are redundant with A and whose eagerness is at least as eager as A ’s eagerness . The first-encountered candidate will win, and the others will be ignored by the prefetch or prerender algorithms. This gives deterministic behavior for authors. The following speculation rules generate two redundant candidates: A user agent which follows the above algorithm will enact both candidates. The second call to the prefetch algorithm will end up doing nothing, and so the request will be made with the default referrer policy, instead of using "no-referrer" . However, the collect tags for matching speculative load candidates algorithm will collect tags from both candidates, so the ` Sec-Speculation-Tags ` header will be set to "a", "b" . This indicates to server operators that either rule could have caused the speculative load. Notwithstanding the above, user agents should prioritize user preferences (express and implied, such as a low-data-usage mode) over eagerness expressed by the author. A user agent’s heuristics for enacting non-eager candidates could incorporate a No-Vary-Search hint . For example, a user hovering over a link whose URL and a candidate’s URL are equivalent modulo search variance given the candidate’s No-Vary-Search hint could indicate to the user agent that enacting it would be useful. We should also cancel speculated prerenders. To collect tags for matching speculative load candidates , given a speculative load candidate candidateUnderConsideration and a list of speculative load candidates allCandidates : Let tags be an empty ordered set . For each candidate of allCandidates : If candidate is not redundant with candidateUnderConsideration , then continue . If candidate ’s eagerness is less eager than candidateUnderConsideration ’s eagerness , then continue . Append candidate ’s tags to tags . Sort in ascending order tags , with tagA being less than tagB if tagA is null, or if tagA is code unit less than tagB . Return tags . The intuition here is that the tag for candidate B will be included in a speculative load triggered by candidate A , if and only if, were candidate A no longer present, B would trigger a speculative load that would be used in the same circumstances as A . 1.8. Document rule predicate matching A document rule predicate predicate matches an Element el implementing the HTMLHyperlinkElementUtils mixin if the following steps return true: If predicate is a document rule conjunction , then: For each clause of predicate ’s clauses : If clause does did not match el , return false. Return true. If predicate is a document rule disjunction , then: For each clause of predicate ’s clauses : If clause matches el , return true. Return false. If predicate is a document rule negation , then: If predicate ’s clause matches el , return false. Return true. If predicate is a document rule URL pattern predicate , then: Let href be run the result of running el ’s href getter steps. For each pattern of predicate ’s patterns : Perform previous step, then start a match referrer-initiated navigational prefetch given pattern and href . If the result is not null, return true. Return false. If predicate is a document rule CSS selector predicate , then: For each selector of predicate ’s selectors : Match selector against el with the scoping root set to el ’s root . If the result is true, return true. During this step, user agents must apply the same privacy restrictions to the :visited pseudo-class as they would to other selector matching logic that could be observed by authors (e.g., querySelector(selectors) ). This is important to prevent this from opening an avenue for attackers to gather information about a user’s browsing history, e.g., by using a selector such as :root:has(.sensitive-site:visited) .report-sensitive-site . See the Privacy Considerations section. Return false. Assert : This step is not reached. 2. Content Security Policy Inline script use is restricted by [CSP] , but there are cases where a developer doesn’t want to permit general inline scripts, but wants to permit inline speculation rules. So, we make the following change that extends [CSP] to support a new source keyword for inline speculation rules. 2.1. Directives In Content Security Policy 3 § 2.3 Directives , we define several associated algorithms, and an inline check algorithm needs a patch to define how to choose the type argument. An inline check , which takes an Element , a type string, a policy, and a source string as arguments, and is executed during Content Security Policy 3 § 4.2.3 Should element’s inline type behavior be blocked by Content Security Policy? and during Content Security Policy 3 § 4.2.4 Should navigation request of type be blocked by Content Security Policy? for javascript: requests. This algorithm returns " Allowed " unless otherwise specified. The type string is set to " script speculationrules " if the Element is HTMLScriptElement and the type attribute is " speculationrules ", or set to " script attribute " for JavaScript event handlers. Otherwise, it is set to " script ". 2.2. Source Lists In Content Security Policy 3 § 2.3.1 Source Lists , we change the following definition to have a new source, inline-speculation-rules . " / "" / "" / " 2.3. Should element’s inline type behavior be blocked by Content Security Policy? Also, we make a following change for a note in Content Security Policy 3 § 4.2.3 Should element’s inline type behavior be blocked by Content Security Policy? . Note: The valid values for type are " script ", " script attribute ", " script speculationrules ", " style ", and " style attribute ". 2.4. script-src Also we make the following change for Content Security Policy 3 § 6.1.10 script-src . Inline script blocks MUST pass through Content Security Policy 3 § 4.2.3 Should element’s inline type behavior be blocked by Content Security Policy? . Their behavior will be blocked unless every policy allows inline script, either implicitly by not specifying a script-src (or default-src ) directive, or explicitly, by specifying " unsafe-inline ", a nonce-source or a hash-source that matches the inline block , or specifying " inline-speculation-rules " on the type attribute being " speculationrules " . 2.5. Does a source list allow all inline behavior for type? The algorithm needs a patch to handle the " script speculationrules " type. For each expression of list: If expression matches the nonce-source or hash-source grammar, return " Does Not Allow ". If type is " script ", " script attribute " or " navigation " and expression matches the keyword-source " 'strict-dynamic' ", return " Does Not Allow ". Note: 'strict-dynamic' only applies to scripts, not other resource types. Usage is explained in more detail in Content Security Policy 3 § 8.2 Usage of "'strict-dynamic'" . If type is " script speculationrules " and expression matches the keyword-source " 'inline-speculation-rules' ", set allow all inline to true . If expression is an ASCII case-insensitive match for the keyword-source " 'unsafe-inline' ", set allow all inline to true . 2.6. Does element match source list for type and source? The algorithm needs patches to handle the " script speculationrules " type at the step 2 and 5. If type is " script ", " script speculationrules ", or " style ", and Content Security Policy 3 § 6.7.3.1 Is element nonceable? returns " Nonceable " when executed upon element : For each expression of list : If expression matches the nonce-source grammar, and element has a nonce attribute whose value is expression ’s base64-value part, return " Matches ". prefetchRecord .

   Note: Nonces only apply to inline script and inline style , not to attributes of either element or to javascript: navigations. Let unsafe-hashes flag be false . For each expression of list : If expression is an ASCII case-insensitive match for the keyword-source " 'unsafe-hashes' ", set unsafe-hashes flag to true . Break out of the loop.

If type is " script ", " script speculationrules ", " style ", or unsafe-hashes flag is true : 2.7. Get the effective directive for request In Content Security Policy 3 § 6.8.1 Get the effective directive for request , the switch on the request destination needs one additional case. At present, requests can only be issued in the case of the ` Speculation-Rules ` header, so CSP does not apply. If support is added for loading external rule sets via <script src> , for which CSP would apply, then the CSP directive selection will need to distinguish this case, such as by the introduction of a new request initiator . " speculationrules " Return null. 3. Fetch 3.1. Destination The string " speculationrules " is added to the list of valid destinations and also to the list of enumerators in RequestDestination . 4. Security considerations 4.1. Cross-site request forgery This specification allows documents to cause HTTP requests to be issued. When any supported action acts on a URL which is same origin to the document, then this does not constitute a risk of cross-site request forgery, since the request uses only the credentials available to the document. Otherwise, requests are always issued without using any previously existing credentials . This limits the ambient authority available to any potentially forged request, and such requests can already be made through [FETCH] , a subresource or frame, or various other means. Site operators are therefore already well-advised to use CSRF tokens or other mitigations for this threat. Because links in a document could be selected using a document rule, if the document may contain user-generated markup then authors should construct their speculation rules to exclude such links that may have harmful side effects, e.g., by using a document rule CSS selector predicate to exclude links in regions with user-generated links or by using a document rule URL pattern predicate to allow only URL patterns known to be safe to fetch without side effects. The ` Speculation-Rules ` header can also cause requests to be issued. These requests are unlikely to be useful in mounting a CSRF attack, because: These requests are sent with credentials mode " same-origin " (the default), so no stored credentials are included in the request, and such credentials are likely to be required to cause unwanted side effects. These requests are unlikely to be useful in inferring the contents of a non-speculation rules resource, because responses with the incorrect MIME type are not honored. These requests are unlikely to be useful in inferring the contents of a speculation rules resource, because they are sent with mode " cors ", and so cross-origin resources must explicitly opt in using ` Access-Control-Allow-Origin `. These requests are distinguishable from requests by other causes in the browser because a separate value, " speculationrules ", is provided in the ` Sec-Fetch-Dest ` request header. 4.2. Cross-site scripting This specification causes activity in response to content found in the document, so it is worth considering the options open to an attacker able to inject unescaped HTML. Such an attacker is otherwise able to inject JavaScript, frames or other elements. The activity possible with this specification (requesting fetches etc) is generally less dangerous than arbitrary script execution, and comparable to other elements. It would, however, make it possible to cause prefetches of links in the document, and the existence of those prefetches could provide a vector for exfiltrating information about those links. The same mitigations available to other features also apply here. In particular, the [CSP] script-src directive applies to the parsing of the speculation rules and the default-src directive applies to prefetch requests arising from the rules. The possibility of leaking link URLs via this mechanism is additionally mitigated by the fact that prefetch and prerender to plaintext HTTP (other than to localhost) is not permitted, and so such an on-path attacker could not directly observe preloading request URLs, but would only have access to metadata and traffic analysis. This does not, however, replace standard XSS protections. It’s generally not expected that user-generated content will be added as arbitrary response headers; server operators are already going to encounter significant trouble if this is possible. It is therefore unlikely that the ` Speculation-Rules ` header meaningfully expands the XSS attack surface. Therefore, [CSP] does not apply to the loading of rule sets via the header. 4.3. Type confusion In the case of speculation rules in an inline <script> , an application which erroneously parsed speculation rules as a JavaScript script (though user agents are instructed not to execute scripts who " type " is unrecognized) would either interpret it as the empty block {} or produce a syntax error, since the U+003A COLON ( : ) after the first key is invalid JavaScript. In neither case would such an application execute harmful behavior. Since the parsing behavior of the <script> element has long been part of HTML, any modern HTML parser would not construct any non-text children of the element. There is thus a low risk of other text hidden inside a <script> element with type="speculationrules" which is parsed as part of the script content by compliant HTML implementations but as HTML tags by others. Authors should, however, still escape any potentially attacker-controlled content inserted into speculation rules. In particular, it may be necessary to escape JSON syntax as well as, if the speculation rules are in an inline <script> tag, the closing </script> tag. [CSP] is a useful additional mitigation for vulnerabilities of this type. Similarly, processing non-speculation rules resources as speculation rules is unlikely because this specification requires implementations to validate that its MIME type has an essence of " application/speculationrules+json" . 4.4. IP anonymization This specification allows authors to request prefetch traffic using IP anonymization technology provided by the user agent. The details of this technology are not a part of this specification; nonetheless some general principles apply. To the extent IP anonymization is implemented using a proxy service, it is advisable to minimize the information available to the service operator and other entities on the network path. This likely involves, at a minimum, the use of [TLS] for the connection. Site operators should be aware that, similar to virtual private network (VPN) technology, the client IP address seen by the HTTP server may not exactly correspond to the user’s actual network provider or location, and a traffic for multiple distinct subscribers may originate from a single client IP address. This may affect site operators' security and abuse prevention measures. IP anonymization measures may make an effort to use an egress IP address which has a similar geolocation or is located in the same jurisdiction as the user, but any such behavior is particular to the user agent and not guaranteed by this specification. 4.5. Mixed content Speculation rules are either inline (so are delivered by the same origin as the document) or fetched via the ` Speculation-Rules ` header (in which case they are blockable as part of should fetching request be blocked as mixed content? ). The speculative actions initiated by this specification may also have similar protections. For example, prefetching of URLs which are not potentially trustworthy is not permitted at all, even from environments which are not themselves secure contexts . 5. Privacy considerations 5.1. Heuristics Because the candidate prefetches and other actions are not required, the user agent can use heuristics to determine which actions would be best to execute. Because it may be observable to the document whether actions were executed, user agents must take care to protect privacy when making such decisions — for instance by only using information which is already available to the origin. If these heuristics depend on any persistent state, that state must be erased whenever the user erases other site data. If the user agent automatically clears other site data from time to time, it must erase such persistent state at the same time. The use of origin here instead of site here is intentional. Origins generally form the basis for the web’s security boundary. Though same-site origins are generally allowed to coordinate if they wish, origins are generally not allowed access to data from other origins, even same-site ones.