What is the issue with the HTML Standard?
I recommend people review https://datatracker.ietf.org/doc/draft-ietf-httpbis-resumable-upload/ with an eye on it becoming an integral part of form submission.
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-resumable-upload#section-4.2.3 has some examples.
One of the tricky aspects is that the upload resource's origin does not have to match the form submission's action's origin.
One suggested model is that if the POST succeeds as normal we use the form submission's action's origin (and show that in the address bar). And that if it does not and we have to PATCH, we pretend a (synthetic) redirect happened and use the upload resource's origin. (Pretend a redirect happened would have to apply the relevant security checks in Fetch.)
We probably also want to limit this to https:.
Not really sure yet on how to specify all of this cleanly.
Corresponding Fetch issue: whatwg/fetch#1626
cc @Acconut @guoye-zhang
What is the issue with the HTML Standard?
I recommend people review https://datatracker.ietf.org/doc/draft-ietf-httpbis-resumable-upload/ with an eye on it becoming an integral part of form submission.
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-resumable-upload#section-4.2.3 has some examples.
One of the tricky aspects is that the upload resource's origin does not have to match the form submission's action's origin.
One suggested model is that if the POST succeeds as normal we use the form submission's action's origin (and show that in the address bar). And that if it does not and we have to PATCH, we pretend a (synthetic) redirect happened and use the upload resource's origin. (Pretend a redirect happened would have to apply the relevant security checks in Fetch.)
We probably also want to limit this to
https:.Not really sure yet on how to specify all of this cleanly.
Corresponding Fetch issue: whatwg/fetch#1626
cc @Acconut @guoye-zhang