Fetch Living Standard

Fetch Living Standard
Name	Fetch Living Standard
Developer	WHATWG
Released	2016
Latest release	2024
Genre	Web standard
License	WHATWG living standard

Fetch Living Standard

The Fetch Living Standard is a web specification that defines the HTTP client-side Web API for making network requests, evolving through collaboration among WHATWG, W3C, and contributors from organizations such as Mozilla Foundation, Google, Microsoft, and Apple Inc.. It originated from discussions around XMLHttpRequest limitations and interoperability issues addressed in forums including IETF working groups, GitHub repositories, and public mailing lists influenced by implementers from Blink (browser engine), Gecko (browser engine), and WebKit. The standard underpins features used by web platforms, progressive web apps discussed at events like Google I/O, WWDC, and Mozilla Festival, and is referenced by implementers in Chromium, Firefox, Safari, and Edge.

Overview

The specification specifies an interface for initiating and controlling fetch requests, defining objects and algorithms used across HTML5, Service Worker, Cross-Origin Resource Sharing, Content Security Policy, and WebSockets. It supersedes parts of XMLHttpRequest behavior by providing a higher-level, promise-based API that interoperates with Streams API, FormData, Request (Fetch API), Response (Fetch API), and Headers (Fetch API). The living document model maintained by WHATWG allows continuous updates similar to processes used by ECMAScript and discussions mirrored in TC39 meetings and W3C Advisory Committee interactions.

Principles and Goals

The Fetch Living Standard aims for interoperability between Blink (browser engine), Gecko (browser engine), WebKit, and other user agents, prioritizing web compatibility informed by Can I use, MDN Web Docs, and issue reports from projects like Node.js and Deno (software) runtimes. Goals include aligning with web security constructs like Same-origin policy, Cross-Origin Resource Sharing, and Subresource Integrity while enabling features used in Progressive web app scenarios and server-driven applications maintained by organizations such as Facebook, Twitter, Netflix, and Spotify (service). It follows principles adopted in standards authored by Tim Berners-Lee, Brendan Eich, Jeffrey Zeldman, and committees including WHATWG Steering Group.

Technical Specification

The technical core defines the Request (Fetch API), Response (Fetch API), Headers (Fetch API), and related Body (Fetch API) mixins alongside algorithms for byte stream handling via the Streams API and integration with ReadableStream and WritableStream. It specifies HTTP semantics tied to RFC 7230, RFC 7231, RFC 7540, and RFC 9110, including handling of status codes referenced in Hypertext Transfer Protocol, header parsing consistent with Internet Engineering Task Force guidance, and redirection behavior modeled after RFC 8297. The spec details promise-based behavior influenced by ECMAScript 2015 promises, exception handling aligning with DOMException semantics, and error modes comparable to Network Error Logging and Reporting API patterns.

Implementation and Adoption

Major browser engines implemented the API: Chromium integrated it within Blink (browser engine), Mozilla implemented it in Gecko (browser engine), and Apple Inc. shipped support in WebKit. Server-side environments such as Node.js, Deno (software), and Cloudflare Workers added compatible fetch-like interfaces for isomorphic JavaScript frameworks like React (JavaScript library), Angular (application framework), and Vue.js. CDNs and platforms including Fastly, Akamai Technologies, Netlify, and Vercel used fetch semantics in edge computing runtimes supporting Service Worker patterns and Single-page application deployment models promoted at conferences like JSConf and NodeConf.

Comparison with Other Standards

Compared with XMLHttpRequest, the Fetch API offers a promise-based model influenced by ECMAScript promises and interoperates with Streams API for streaming response bodies; in contrast, XMLHttpRequest follows a callback/event model codified during the Web 2.0 era. Compared to server-side HTTP client libraries such as libcurl, Requests (software), and HttpClient (Java), fetch emphasizes browser-centric security constraints like Same-origin policy and Cross-Origin Resource Sharing rather than features prioritized in Apache HTTP Server or Nginx. In relation to newer proposals like GraphQL transport layers and WebTransport, Fetch remains the common denominator for generic HTTP traffic and is referenced by tooling from Webpack, Rollup (software), and Babel (software).

Criticisms and Limitations

Critiques highlight behavioral differences between implementations in Chromium, Gecko (browser engine), and WebKit leading to cross-browser edge cases tracked in GitHub issues and WHATWG issue trackers. Limitations include lack of built-in retry strategies compared to libraries such as Axios (HTTP client), absence of advanced cookie management present in libcurl, and nuanced CORS handling that affects integrations with services like Firebase, AWS Lambda, and Heroku. Security analysts referencing incidents involving Cross-site scripting and Cross-site request forgery note that misuse of Fetch in complex Service Worker scenarios can introduce vulnerabilities audited by teams at OWASP and CERT Coordination Center.

Category:Web standards