Headers.append() - Web APIs
value the value of the http header you want to add. ...
... value the value of the http header you want to add. ...
...ppends a new value onto an existing header inside a headers object, or adds the header if it does not already exist. the difference between set() and append() is that if the specified header already exists and accepts multiple values, set() will overwrite the existing value with the new one, whereas append() will append the new value onto the end of the set of values. for security reasons, some headers can only be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.append(name, value); parameters name the name of the http header you want to add to the headers object. value the value of the http header you want to add. returns void. ...
...And 2 more matches

Headers.delete() - Web APIs
the delete() method of the headers interface deletes a header from the current headers object. this method throws a typeerror for the following reasons: the value of the name parameter is not the name of an http header. the value of guard is immutable. for security reasons, some headers can only be controller by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.delete(name); parameters name the name of the http header you want to delete from the headers object. returns void. ...
...t the name of an http header. the value of guard is immutable. for security reasons, some headers can only be controller by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.delete(name); parameters name the name of the http header you want to delete from the headers object. returns void. ...
...e value of guard is immutable. for security reasons, some headers can only be controller by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.delete(name); parameters name the name of the http header you want to delete from the headers object. returns void. ...
...And 2 more matches

Headers.has() - Web APIs
the has() method of the headers interface returns a boolean stating whether a headers object contains a certain header. for security reasons, some headers can only be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.has(name); parameters name the name of the http header you want to test for. if the given name is not a valid http header name, this method throws a typeerror. returns a boolean. ...
.... for security reasons, some headers can only be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.has(name); parameters name the name of the http header you want to test for. if the given name is not a valid http header name, this method throws a typeerror. returns a boolean. ...
...ders can only be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.has(name); parameters name the name of the http header you want to test for. if the given name is not a valid http header name, this method throws a typeerror. returns a boolean. ...
...be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. syntax myheaders.has(name); parameters name the name of the http header you want to test for. if the given name is not a valid http header name, this method throws a typeerror. returns a boolean. example creating an empty headers object is simple: var myheaders = new headers(); // currently empty you could add a header to this using headers.append, then test for the existence of it using has(): myheaders.append('content-type', 'image/jpeg'); myheaders.has('content-type'); // returns true myheaders.has('accept-encoding'); // returns false specifications specification status comment fetchthe definition of 'has()' in that specification. l...

Installing headers using EXPORTS
public headers and idl files are copied during the export phase of the build. this is accomplished by setting make variables telling the build system which module the headers are for (since headers are organized by module under <tt>dist/include</tt>), and which headers need to be created from idl files by xpidl. for all <tt>makefile.in</tt>s which export public headers, you should set module to the module name where the files should be copied to in <tt>dist/include</tt>. for normal headers that are to be exported, you should set exports to the list of headers to be exported. they will be copied to <tt>dist/include/$(module)</tt>. for xpidl-generated headers, you should set xpidlsrcs to the list of idl files to export. these idl files will be copied to <tt>dist/idl</tt>, and the gener...
...he module name where the files should be copied to in <tt>dist/include</tt>. for normal headers that are to be exported, you should set exports to the list of headers to be exported. they will be copied to <tt>dist/include/$(module)</tt>. for xpidl-generated headers, you should set xpidlsrcs to the list of idl files to export. these idl files will be copied to <tt>dist/idl</tt>, and the generated headers will be copied to <tt>dist/include/$(module)</tt>. for xpidl-generated headers, you may also set xpidl_module to determine which typelib file is produced from the idl files. the distinction between xpidl_module and module is that each directory with idl files must have a unique typelib file, but several directories may export headers to the same location. here is an example <tt>makefile.in</...
...lude/$(module)</tt>. for xpidl-generated headers, you may also set xpidl_module to determine which typelib file is produced from the idl files. the distinction between xpidl_module and module is that each directory with idl files must have a unique typelib file, but several directories may export headers to the same location. ...

Setting HTTP request headers
http channels when you deal with http requests and responses, typically you are doing this with an nsihttpchannel. ...
...http channels when you deal with http requests and responses, typically you are doing this with an nsihttpchannel. ...

Response.headers - Web APIs
the headers read-only property of the response interface contains the headers object associated with the response. syntax var myheaders = response.headers; value a headers object. example in our fetch response example (see fetch response live) we create a new request object using the request() constructor, passing it a jpg path. we then fetch this request using fetch(), extract a blob from the response using body.blob, create an object url out of it using url.createobjecturl, and display this in an <img>. note that at the top of the fetch() block we log the response headers value to the console. ...
...g fetch(), extract a blob from the response using body.blob, create an object url out of it using url.createobjecturl, and display this in an <img>. note that at the top of the fetch() block we log the response headers value to the console. var myimage = document.queryselector('img'); var myrequest = new request('flowers.jpg'); fetch(myrequest).then(function(response) { console.log(response.headers); // returns a headers{} object response.blob().then(function(myblob) { var objecturl = url.createobjecturl(myblob); myimage.src = objecturl; }); }); specifications specification status comment fetchthe definition of 'headers' in that specification. living standard initial definition ...

Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ - HTTP
reason reason: invalid token ‘xyz’ in cors header ‘access-control-allow-headers’ what went wrong? the response to the cors request that was sent by the server includes an access-control-allow-headers header which includes at least one invalid header name. the access-control-allow-headers header is sent by the server in response to a preflight request; it lets the client know which http headers are permitted in cors requests. if the client user agent finds among the comma-delineated values provided by the header any header name it does not recognize, this error occurs. this is a problem that most likely can only be fixed on the server side, by modifying the server's configuration to no longer send the invalid or unknown header name with the access-control-allow-headers header. it may...

Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel - HTTP
reason reason: missing token ‘xyz’ in cors header ‘access-control-allow-headers’ from cors preflight channel what went wrong? the access-control-allow-headers header is sent by the server to let the client know which headers it supports for cors requests. the value of access-control-allow-headers should be a comma-delineated list of header names, such as "x-custom-information" or any of the standard but non-basic header names (which are always allowed). this error occurs when attempting to preflight a header that is not expressly allowed (that is, it's not included in the list specified by the access-control-allow-headers header sent by the server). to fix this, the server needs to be updated so that it allows the indicated header, or you need to avoid using that header. ...

Access-Control-Request-Headers - HTTP
the access-control-request-headers request header is used by browsers when issuing a preflight request, to let the server know which http headers the client might send when the actual request is made. header type request header forbidden header name yes syntax access-control-request-headers: <header-name>, <header-name>, ... directives <header-name> a comma-delimited list of http headers that are included in the request. examples access-control-request-headers: x-pingother, content-type specifications specification status comment fetchthe definition of 'access-control-request-headers' in that specification. living standard initial definition. ...

WebRequest.jsm
n code. there are some differences between this api and chrome's, though: see chrome incompatibilities for the details. usage to import webrequest, use code like: let {webrequest} = cu.import("resource://gre/modules/webrequest.jsm", {}); the webrequest object has the following properties, each of which corresponds to a specific stage in executing a web request: onbeforerequest onbeforesendheaders onsendheaders onheadersreceived onresponsestarted oncompleted each of these objects defines two functions: addlistener(callback, filter, opt_extrainfospec) removelistener(callback) adding listeners use addlistener to add a listener to a particular event. it takes one mandatory argument and two optional arguments, as detailed below. name type description c...
...ray containing the string "blocking" as the third argument to your addlistener() call. this tells the browser to wait for your event listener to return before continuing with the request. next, return an object from the listener that contains instructions for what the browser should do with this request. there are four things you can do with a request: cancel it redirect it modify request headers modify response headers. to perform one of these operations, include a property with the appropriate name in the object returned from the listener, and assign it the desired value, as detailed in the table below: operation available in return property cancel onbeforerequest cancel boolean value set to true. see some examples of canceling requests. ...
...orm one of these operations, include a property with the appropriate name in the object returned from the listener, and assign it the desired value, as detailed in the table below: operation available in return property cancel onbeforerequest cancel boolean value set to true. see some examples of canceling requests. redirect onbeforesendheaders redirecturl string set to the url to redirect the request to. see some examples of redirection. modify request headers onbeforesendheaders requestheaders array of http headers. modify response headers onheadersreceived responseheaders array of http headers. see some examples of canceling, redirecting, and modifying ...
...And 26 more matches

Using Fetch - Web APIs
s: the promise returned from fetch() won’t reject on http error status even if the response is an http 404 or 500. instead, it will resolve normally (with ok status set to false), and it will only reject on network failure or if anything prevented the request from completing. fetch() won't can receive cross-site cookies; you can’t can establish a cross site session using fetch. set-cookie headers from other sites are silently ignored. fetch won’t send cookies, unless you set the credentials init option. (since aug 25, 2017. the spec changed the default credentials policy to same-origin. firefox changed since 61.0b13.) a basic fetch request is really simple to set up. have a look at the following code: fetch('http://example.com/movies.json') .then(response => response.json()) .th...
...t method implementation: async function postdata(url = '', data = {}) { // default options are marked with * const response = await fetch(url, { method: 'post', // *get, post, put, delete, etc. ...
... fetch('https://exam...
...And 23 more matches

Cross-Origin Resource Sharing (CORS) - HTTP
a web application executes a cross-origin http request when it requests a resource that has a different origin (domain, protocol, or port) from its own. an example of a cross-origin request: the front-end javascript code served from https://domain-a.com uses xmlhttprequest to make a request for https://domain-b.com/data.json. for security reasons, browsers restrict cross-origin http requests initiated from scripts. for example, xmlhttprequest and the fetch api follow the same-origin policy. ...
... for https://domain-b.com/data.json. for security reasons, browsers restrict cross-origin http requests initiated from scripts. for example, xmlhttprequest and the fetch api follow the same-origin policy. this means that a web application using those apis can only request resources from the same origin the application was loaded from unless the response from other origins includes the right cors headers. the cors mechanism supports secure cross-origin requests and data transfers between browsers and servers. modern browsers use cors in apis such as xmlhttprequest or fetch to mitigate the risks of cross-origin http requests. who should read this article? everyone, really. more specifically, this article is for web administrators, server developers, and front-end developers. modern browsers ...
...sts and data transfers between browsers and servers. modern browsers use cors in apis such as xmlhttprequest or fetch to mitigate the risks of cross-origin http requests. who should read this article? everyone, really. more specifically, this article is for web administrators, server developers, and front-end developers. modern browsers handle the client side of cross-origin sharing, including headers and policy enforcement. but the cors standard means servers have to handle new request and response headers. another article for server developers discussing cross-origin sharing from a server perspective (with php code snippets) is supplementary reading. what requests use cors? this cross-origin sharing standard can enable cross-site http requests for: invocations of the xmlhttprequest or f...
...And 22 more matches

HTTP Index - HTTP
s of http guide, http, overview http is a pretty extensible protocol. it relies on a few basic concepts like the notion of resources and uris, a simple structure of messages, and a client-server structure for the communication flow. on top of these basic concepts, numerous extensions have appeared over the years, adding new functionality and new semantics by creating new http methods or headers. 5 choosing between www and non-www urls guide, http, url a recurring question among website owners is whether to choose non-www or www urls. this page provides some advice on what's best. 6 data urls base64, guide, http, intermediate, url data urls, urls prefixed with the data: scheme, allow content creators to embed small files inline in documents. ...
...plements cross-origin read blocking (corb), which is a mechanism to prevent some cross-origin reads by default. 20 cross-origin resource sharing (cors) ajax, cors, cross-origin resource sharing, fetch, fetch api, http, http access controls, same-origin policy, security, xmlhttprequest, l10n:priority cross-origin resource sharing (cors) is a mechanism that uses additional http headers to tell browsers to give a web application running at one origin, access to selected resources from a different origin. 21 cors errors cors, errors, http, https, messages, same-origin, security, console, troubleshooting cross-origin resource sharing (cors) is a standard that allows a server to relax the same-origin policy. this is used to explicitly allow some cross-origin re...
...s’ cors, corsmissingallowcredentials, cross-origin, error, http, https, messages, reasons, security, console, troubleshooting the cors request requires that the server permit the use of credentials, but the server's access-control-allow-credentials header's value isn't set to true to enable their use. 34 reason: invalid token ‘xyz’ in cors header ‘access-control-allow-headers’ cors, corsinvalidallowheader, cross-origin, error, http, https, messages, reasons, security, console, troubleshooting the response to the cors request that was sent by the server includes an access-control-allow-headers header which includes at least one invalid header name. 35 reason: invalid token ‘xyz’ in cors header ‘access-control-allow-methods’ cors, cors...
...And 22 more matches

Index - Web APIs
dom, document, needsspectable, property, reference the document.compatmode property indicates whether the document is rendered in quirks mode or standards mode. 875 document.contenttype api, dom, document, mime, property, read-only, reference the document.contenttype read-only property returns the mime type that the document is being rendered as. this may come from http headers or other sources of mime information, and might be affected by automatic type conversions performed by either the browser or extensions. 876 document.cookie api, dom, document, html dom, js, needsmarkupwork, reference, storage, cookie the document property cookie lets you read and write cookies associated with the document. it serves as a getter and setter for the actual valu...
...eval behavior). when a cross-origin fetch involving a relative url is initiated from an <iframe>, the relative url used to be resolved against the current global location, rather than the iframe's location. 1300 fetch basic concepts api, fetch, fetch api, xmlhttprequest, concepts, guard, request at the heart of fetch are the interface abstractions of http requests, responses, headers, and body payloads, along with a global fetch method for initiating asynchronous resource requests. because the main components of http are abstracted as javascript objects, it is easy for other apis to make use of such functionality. 1301 using fetch api, body, experimental, fetch, guide, http, promise, response, fetch post & string body, request this kind of functionality w...
...index read-only property represents the position of a row in relation to the whole <table>. 1937 htmltablesectionelement api, html dom, interface, reference the htmltablesectionelement interface provides special properties and methods (beyond the htmlelement interface it also has available to it by inheritance) for manipulating the layout and presentation of sections, that is headers, footers and bodies, in an html table. 1938 htmltemplateelement api, html dom, htmltemplateelement, interface, reference, web components the htmltemplateelement interface enables access to the contents of an html <template> element. 1939 htmltemplateelement.content api, html dom, htmltemplateelement, property, reference, web components the htmltemplateele...
...And 20 more matches

nsIHttpChannel
netwerk/protocol/http/nsihttpchannel.idlscriptable this interface allows for the modification of http request parameters and the inspection of the resulting http response status and headers when they become available. inherits from: nsichannel last changed in gecko 1.3 to create an http channel, use nsiioservice with a http uri, for example: var ios = components.classes["@mozilla.org/network/io-service;1"] .getservice(components.interfaces.nsiioservice); var ch = ios.newchannel("https://www.example.com/", null, null); method overview void getoriginalresponseheader(in acstring aheader, in nsihttpheadervisitor avisitor); acstring getrequestheader(in acstring aheader); acstring getresponseheader(in acstring header); boolea...
... redirectto(in nsiuri anewuri); void setemptyrequestheader(in acstring aheader); void setreferrerwithpolicy(in nsiuri referrer, in unsigned long referrerpolicy); void setrequestheader(in acstring aheader, in acstring avalue, in boolean amerge); void setresponseheader(in acstring header, in acstring value, in boolean merge); void visitoriginalresponseheaders(in nsihttpheadervisitor avisitor); void visitrequestheaders(in nsihttpheadervisitor avisitor); void visitresponseheaders(in nsihttpheadervisitor avisitor); constants constant description referrer_policy_no_referrer_when_downgrade default; indicates not to pass on the referrer when downgrading from https to http referrer_policy_no_referre...
...s not pass certain security checks (e.g., a "https://" url will never be sent as the referrer for a plaintext http request). the implementation is not required to throw an exception when the referrer uri is rejected. exceptions thrown ns_error_in_progress if set after the channel has been opened. ns_error_failure if used for setting referrer during visitrequestheaders(). getting the value will not throw. requestmethod acstring set or get the http request method (default is "get"). setter is case insensitive; getter returns an uppercase string. this attribute may only be set before the channel is opened. note: the data for a "post" or "put" request can be configured via nsiuploadchannel. however, after setting the upl...
...And 13 more matches

Index - MDN Web Docs Glossary: Definitions of Web-related terms
sing, content management system, glossary a cms (content management system) is software that allows users to publish, organize, change, or remove various kinds of content, not only text but also embedded images, video, audio, and interactive code. ...
... 48 cors glossary, infrastructure, security cors (cross-origin resource sharing) is a system, consisting of transmitting http headers, that determines whether browsers block frontend javascript code from accessing responses for cross-origin requests. 49 cors-safelisted request header cors, fetch a cors-safelisted request header is one of the following http headers: 50 cors-safelisted response header cors, fetch, glossary, http a cors-safelisted response header is an http header which has been safelisted so that it will not be filtered when responses are processed by cors, since they're considered safe (as the headers listed in access-control-expose-headers). 51 crlf cr, crlf, glossary, infrastructure, lf, carriage return...
...d otherwise be interpreted as html code), and invisible characters (like non-breaking spaces). you can also use them in place of other characters that are difficult to type with a standard keyboard. 134 entity header glossary, webmechanics an entity header is an http header that can be used in an http request or response, and describes the content of the body of themessage. headers like content-length, content-language, content-encoding are entities headers. 135 event codingscripting, glossary events are assets generated by dom elements, which can be manipulated by a javascript code. 136 exception beginner, codingscripting, glossary an exception is a condition that interrupts normal code execution. in javascript syntax errors are a ...
...And 11 more matches

Network request details - Firefox Developer Tools
quest details clicking on a row displays a new pane in the right-hand side of the network monitor, which provides more detailed information about the request. the screenshots and descriptions in this section reflect firefox 78. earlier versions appeared similarly, but might not include some functionality. ...
... this includes: information about the request status: the response status code for the request; click the "?" icon to go to the reference page for the status code. version: the version of http used. ...
... this includes: information about the request status: the response status code for the request; click the "?" icon to go to the reference page for the status code. version: the version of http used. transferred: the amount of data transferred for the request. ...
...And 11 more matches

HTML table advanced features and accessibility - Learn web development
e let's put these new elements into action. first of all, make a local copy of spending-record.html and minimal-table.css in a new folder. try opening it in a browser — you'll see that it looks ok, but it could stand to be improved. the "sum" row that contains a summation of the spent amounts seems to be in the wrong place, and there are some details missing from the code. put the obvious headers row inside a <thead> element, the "sum" row inside a <tfoot> element, and the rest of the content inside a <tbody> element. save and refresh, and you'll see that adding the <tfoot> element has caused the "sum" row to go down to the bottom of the table. next, add a colspan attribute to make the "sum" cell span across the first four columns, so the actual number appears at the bottom of the "cost...
...ed users let's recap briefly on how we use data tables. a table can be a handy tool, for giving us quick access to data and allowing us to look up different values. for example, it takes only a short glance at the table below to find out how many rings were sold in gent last august. to understand its information we make visual associations between the data in this table and its column and/or row headers. items sold august 2016 clothes accessories trousers skirts dresses bracelets rings belgium antwerp 56 22 43 72 23 gent 46 18 50 61 15 brussels 51 27 38 69 28 the netherlands amsterdam 89 34 69 85 38 utrecht 80 12 43 36 19...
... text but interpreting a table can be quite a challenge for a blind person. nevertheless, with the proper markup we can replace visual associations by programmatic ones. note: there are around 253 million people living with visual impairment according to who data in 2017. this section of the article provides further techniques for making tables as accessible as possible. ...
...And 10 more matches

Index - HTTP
an http header consists of its case-insensitive name followed by a colon ':', then by its value (without line breaks). leading white space before the value is ignored. 2 accept http, http header, reference, request header the accept request http header advertises which content types, expressed as mime types, the client is able to understand. ...
.... the value of this field indicates the unit that can be used to define a range. 7 access-control-allow-credentials cors, http, reference, header the access-control-allow-credentials response header tells browsers whether to expose the response to frontend javascript code when the request's credentials mode (request.credentials) is "include". 8 access-control-allow-headers cors, http, reference, header the access-control-allow-headers response header is used in response to a preflight request which includes the access-control-request-headers to indicate which http headers can be used during the actual request. 9 access-control-allow-methods cors, http, reference, header the access-control-allow-methods response header specifies the me...
...ght request. 10 access-control-allow-origin access control, access-control-allow-origin, cors, dealing with cors, http, http header, how to fix cors, reference, security, cross-origin issue, header, origin the access-control-allow-origin response header indicates whether the response can be shared with requesting code from the given origin. 11 access-control-expose-headers cors, http, reference, header the access-control-expose-headers response header indicates which headers can be exposed as part of the response by listing their names. 12 access-control-max-age cors, http, reference, header the access-control-max-age response header indicates how long the results of a preflight request (that is the information contained in the access...
...And 10 more matches

HTTP Messages - HTTP
binary framing mechanism has been designed to not require any alteration of the apis or config files applied: it is broadly transparent to the user. http requests, and responses, share similar structure and are composed of: a start-line describing the requests to be implemented, or its status of whether successful or a failure. this start-line is always a single line. an optional set of http headers specifying the request, or describing the body included in the message. a blank line indicating all meta-information for the request has been sent. an optional body containing data associated with the request (like content of an html form), or the document associated with a response. the presence of the body and its size is specified by the start-line and http headers. the start-line and http...
...specifying the request, or describing the body included in the message. a blank line indicating all meta-information for the request has been sent. an optional body containing data associated with the request (like content of an html form), or the document associated with a response. the presence of the body and its size is specified by the start-line and http headers. the start-line and http headers of the http message are collectively known as the head of the requests, whereas its payload is known as the body. http requests start line http requests are messages sent by the client to initiate an action on the server. their start-line contain three elements: an http method, a verb (like get, put or post) or a noun (like head or options), that describes the action to be performed. for ...
...thority form. it is only used with connect when setting up an http tunnel. connect developer.mozilla.org:80 http/1.1 the asterisk form, a simple asterisk ('*') is used with options, representing the server as a whole. options * http/1.1 the http version, which defines the structure of the remaining message, acting as an indicator of the expected version to use for the response. ...
...And 9 more matches

Building accessible custom components in XUL - Archive of obsolete content
er-simple spreadsheet download stage-1.zip install stage-1.xpi to build our xul spreadsheet, we'll use three built-in xul controls: a single grid element to contain the other elements and position them in rows and columns. description elements for each row and column header. label elements for each cell in the spreadsheet. the xul markup is straightforward. we define the grid, then define the headers for each row (numbered 1 through 7), then define the column header and cells for each column. the label for each header and cell is defined in the value attribute. the flex attributes are simply for layout. note: the row and column headers are denoted by description elements, and individual cells are denoted by label elements. this is not an accessibility requirement; as we'll see in the next sec...
...rows and 5 columns</caption> although this has the visual layout of a spreadsheet, assistive technologies will only see it as a collection of individual, unrelated text labels. if we inspect this with the msaa inspect32 tool, we see that each cell is exposed as role="text". <caption>it looks like a cell, but it's not</caption> assistive technologies also have no idea that our row headers and column headers are really headers. again, they are exposed as role="text". <caption>it looks like a column header, but it's not</caption> so, before we do anything else, we need to tell assistive technologies that all of these unrelated elements are actually related. this is where dhtml accessibility comes in. further reading grid element reference description element reference labe...
...ace. we will need to declare this namespace as well (xmlns:wairole="http://www.w3.org/2005/01/wai-rdf/guiroletaxonomy#"), and then use this namespace prefix (wairole:) as part of the role attribute value. this will become clearer with some concrete examples: the grid element is the container for the entire control; it gets a role of "wairole:spreadsheet". some of the description elements are row headers, and others are column headers. they each get the appropriate role, "wairole:rowheader" or "wairole:columnheader". each label element is an individual cell and needs a role of "wairole:gridcell". this means we actually need to declare two namespaces, the xhtml 2 namespace and the wairole namespace. we can declare both of them at the top of our .xul file and then reuse them as often as we need. <...
...And 6 more matches

Web Console remoting - Firefox Developer Tools
debugger is used in the web console code, look in browser/devtools/webconsole/webconsole.js, and search for webconsoleconnectionproxy. the new web console actors are: the webconsoleactor allows js evaluation, autocomplete, start/stop listeners, etc. the networkeventactor is used for each new network request. the client can request further network event details - like response body or request headers. to attach to the webconsoleactor, follow these steps: connecttoserver() // the usual listtabs() pickthetabyouwant() debuggerclient.attachconsole(tab.consoleactor, listeners, onattachconsole) the listeners argument is an array which specifies listeners you want to start in the web console. these can be: page errors, window.console api messages, network activity, and file activity. for exampl...
...ent only when your client is attached to the global console actor, it does not make sense for tab console actors. this notification has been introduced in firefox 24. send http requests starting with firefox 25 you can send an http request using the console actor: { "to": "conn0.console9", "type": "sendhttprequest", "request": { "url": "http://localhost", "method": "get", "headers": [ { name: "header-name", value: "header value", }, // ... ], }, } the response packet is a network event actor grip: { "to": "conn0.console9", "eventactor": { "actor": "conn0.netevent14", "starteddatetime": "2013-08-26t19:50:03.699z", "url": "http://localhost", "method": "get" "isxhr": true, "private": false } } you can ...
...n firefox 24). the networkeventactor the new network event actor stores further request and response information. the networkeventupdate packet the web console ui needs to be kept up-to-date when changes happen, when new stuff is added. the new networkeventupdate packet is sent for this purpose. ...
...And 6 more matches

HTTP conditional requests - HTTP
h the value of a validator. such requests can be useful to validate the content of a cache, and sparing a useless control, to verify the integrity of a document, like when resuming a download, or when preventing to lose updates when uploading or modifying a document on the server. principles http conditional requests are requests that are executed differently, depending on the value of specific headers. ...
...a validator. such requests can be useful to validate the content of a cache, and sparing a useless control, to verify the integrity of a document, like when resuming a download, or when preventing to lose updates when uploading or modifying a document on the server. principles http conditional requests are requests that are executed differently, depending on the value of specific headers. these headers define a precondition, and the result of the request will be different if the precondition is matched or not. the different behaviors are defined by the method of the request used, and by the set of headers used for a precondition: for safe methods, like get, which usually tries to fetch a document, the conditional request can be used to send back the document, if relevant only. therefore, th...
... like get, which usually tries to fetch a document, the conditional request can be used to send back the document, if relevant only. therefore, this spares bandwidth. for unsafe methods, like put, which usually uploads a document, the conditional request can be used to upload the document, only if the original it is based on is the same as that stored on the server. validators all conditional headers try to check if the resource stored on the server matches a specific version. to achieve this, the conditional requests need to indicate the version of the resource. as comparing the whole resource byte to byte is impracticable, and not always what is wanted, the request transmits a value describing the version. such values are called validators, and are of two kinds: the date of last modifica...
...And 6 more matches

HTML table basics - Learn web development
commonly used in human society, and have been for a long time, as evidenced by this us census document from 1800: it is therefore no wonder that the creators of html provided a means by which to structure and present tabular data on the web. how does a table work? the point of a table is that it is rigid. information is easily interpreted by making visual associations between row and column headers. look at the table below for example and find a jovian gas giant with 62 moons. you can find the answer by associating the relevant row and column headers. data about the planets of our solar system (planetary facts taken from nasa's planetary fact sheet - metric. name mass (1024kg) diameter (km) density (kg/m3) gravity (m/s2) length of day (hours) distance from s...
...onal <tr> element, with each cell contained in a <td>. this should result in a table that looks something like the following: hi, i'm your first cell. i'm your second cell. i'm your third cell. i'm your fourth cell. second row, first cell. cell 2. cell 3. cell 4. note: you can also find this on github as simple-table.html (see it live also). adding headers with <th> elements now let's turn our attention to table headers — special cells that go at the start of a row or column and define the type of data that row or column contains (as an example, see the "person" and "age" cells in the first example shown in this article). to illustrate why they are useful, have a look at the following table example. first the source code: <table> <tr> <td...
...other-in-law me me sister-in-law eating habits eats everyone's leftovers nibbles at food hearty eater will eat till he explodes the problem here is that, while you can kind of make out what's going on, it is not as easy to cross reference data as it could be. if the column and row headings stood out in some way, it would be much better. active learning: table headers let's have a go at improving this table. first, make a local copy of our dogs-table.html and minimal-table.css files in a new directory on your local machine. the html contains the same dogs example as you saw above. to recognize the table headers as headers, both visually and semantically, you can use the <th> element ('th' stands for 'table header'). this works in exactly the same way as a...
...And 5 more matches

Request() - Web APIs
ject exists on another origin to the constructor call, the request.referrer is stripped out. if this object has a request.mode of navigate, the mode value is converted to same-origin. init optional an options object containing any custom settings that you want to apply to the request. the possible options are: method: the request method, e.g., get, post. the default is get. headers: any headers you want to add to your request, contained within a headers object or an object literal with bytestring values. body: any body that you want to add to your request: this can be a blob, buffersource, formdata, urlsearchparams, usvstring, or readablestream object. note that a request using the get or head method cannot have a body. mode: the mode you want to use for the request, e.
...}); note that you could also pass the init object into the fetch call to get the same effect, e.g.: ...
...}); note that you could also pass the init object into the fetch call to get the same effect, e.g.: fetch(myreques...
...And 5 more matches

nss tech note5
/ be sure to look for sample code first for things you need to do. note: this document contains code snippets that focus on essential aspects of the task and often do not illustrate all the cleanup that needs to be done. also, this document does not attempt to be an exhaustive survey of all possible ways to do a certain task; it merely tries to show a certain way. encrypt/decrypt include headers #include "nss.h" #include "pk11pub.h" make sure nss is initialized.the simplest init function, in case you don't need a nss database is nss_nodb_init(".") choose a cipher mechanism. note that some mechanisms (*_pad) imply the padding is handled for you by nss. if you choose something else, then data padding is the application's responsibility. you can find a list of cipher mechani...
...m, pr_true); pk11_freeslot(slot);</big> note: aes encryption, a fixed blocksize of 16 bytes is used. the rijndael algorithm permits 3 blocksizes (16, 24, 32 bytes), but the aes standard requires the blocksize to be 16 bytes. the keysize can vary and these keysizes are permitted: 16, 24, 32 bytes. you can also look at a sample program illustrating encryption hash / digest include headers #include "nss.h" #include "pk11pub.h" make sure nss is initialized.the simplest init function, in case you don't need a nss database is nss_nodb_init(".") <big>create digest context</big>. some of the digest algorithm identifiers are (without the sec_oid_ prefix) : md2, md5, sha1, sha256, sha384, sha512. pk11context* digestcontext = pk11_createdigestcontext(sec_oid_md5); <bi...
...you can find a list of digest mechanisms in security/nss/lib/softoken/pkcs11.c - grep for ckf_digest. ck_mechanism_type digestmech = ckm_md5 <big>(for example)</big> choose a slot on which to to ...
...And 4 more matches

nsIPluginHost
r); native code only! void ispluginenabledforextension(in string aextension, in constcharstarref amimetype); native code only! void ispluginenabledfortype(in string amimetype); native code only! void loadplugins(); native code only! void newpluginnativewindow(out nspluginnativewindowptr apluginnativewindow); native code only! void parsepostbuffertofixheaders(in string ainpostdata, in unsigned long ainpostdatalen, out string aoutpostdata, out unsigned long aoutpostdatalen); native code only! void reloadplugins(in boolean reloadpages); void setisscriptableinstance(in nsiplugininstance ainstance, in boolean ascriptable); native code only! obsolete since gecko 2.0 void setupplugininstance(in string amimetype, in nsiuri aurl,...
...es plugin native window object created by newpluginnativewindow(). void deletepluginnativewindow( in nspluginnativewindowptr apluginnativewindow ); parameters apluginnativewindow native code only!destroy void destroy(); parameters none. native code only!findproxyforurl fetches a url. (corresponds to npn_geturl and npn_geturlnotify.) posts to a url with post data and/or post headers. (corresponds to npn_posturl and npn_posturlnotify.) returns the proxy info for a given url. the caller is required to free the resulting memory with nsimalloc.free(). the result will be in the following format. "direct" -- no proxy "proxy xxx.xxx.xxx.xxx" -- use proxy "socks xxx.xxx.xxx.xxx" -- use socks mixed. for example "proxy 111.111.111.111;proxy 112.112.112.112", "proxy 111.111.111...
...oid ispluginenabledfortype( in string amimetype ); parameters amimetype native code only!loadplugins void loadplugins(); parameters none. native code only!newpluginnativewindow creates a new plugin native window object. void newpluginnativewindow( out nspluginnativewindowptr apluginnativewindow ); parameters apluginnativewindow native code only!parsepostbuffertofixheaders this method parses post buffer to find out case insensitive "content-length" string and cr or lf some where after that, then it assumes there is http headers in the input buffer and continue to search for end of headers (crlfcrlf or lflf). it will *always malloc()* output buffer (caller is responsible to free it) if input buffer starts with lf, which comes from 4.x spec http://developer.netsca...
...And 4 more matches

Evolution of HTTP - HTTP
requests consist of a single line and start with the only possible method get followed by the path to the resource (not the url as both the protocol, server, and port are unnecessary once connected to the server). get /mypage.html the response is extremely simple too: it only consisted of the file itself. <html> a very simple html page </html> unlike subsequent evolutions, there were no http headers, meaning that only html files could be transmitted, but no other type of documents. there were no status or error codes: in case of a problem, a specific html file was send back with the description of the problem contained in it, for human consumption. http/1.0 – building extensibility http/0.9 was very limited and both browsers and servers quickly extended it to be more versatile: versio...
... at this point, a typical request and response looked like this: get /mypage.html http...
... allowing the browser itself to understand the success or failure of the request and to adapt its behavior in consequence (like in updating or using its local cache in a specific way) the notion of http headers has been introduced, both for the requests and the responses, allowing metadata to be transmitted and making the protocol extremely flexible and extensible. with the help of the new http headers, the ability to transmit other documents than plain html files has been added (thanks to the content-type header). at this point, a typical request and response looked like this: get /mypage.html http/1.0 user-agent: ncsa_mosaic/2.0 (windows 3.1) 200 ok date: tue, 15 nov 1994 08:12:31 gmt server: cern/3.0 libwww/2.17 content-type: text/html <html> a page with an image <img src="/myimage.gif...
...And 4 more matches

Content negotiation - HTTP
entation to the client. the overall resource, as well as each of the representations, have a specific url. how a specific representation is chosen when the resource is called is determined by content negotiation and there are several ways of negotiating between the client and the server. the determination of the best suited representation is made through one of two mechanisms: specific http headers by the client (server-driven negotiation or proactive negotiation), which is the standard way of negotiating a specific kind of resource. the 300 (multiple choices) or 406 (not acceptable) http response codes by the server (agent-driven negotiation or reactive negotiation), that are used as fallback mechanisms. over the years, other content negotiation proposals, like transparent content negot...
...), that are used as fallback mechanisms. over the years, other content negotiation proposals, like transparent content negotiation and the alternates header, have been proposed. they failed to get traction and got abandoned. ...
...nisms. over the years, other content negotiation proposals, like transparent content negotiation and the alternates header, have been proposed. they failed to get traction and got abandoned. server-driven content negotiation in server-driven content negotiation, or proactive content negotiation, the browser (or any other kind of user-agent) sends several http headers along with the url. ...
...And 4 more matches

An overview of HTTP - HTTP
storical information) basic aspects of http http is simple http is generally designed to be simple and human readable, even with the added complexity introduced in http/2 by encapsulating http messages into frames. http messages can be read and understood by humans, providing easier testing for developers, and reduced complexity for newcomers. http is extensible introduced in http/1.0, http headers make this protocol easy to extend and experiment with. new functionality can even be introduced by a simple agreement between a client and a server about a new header's semantics. http is stateless, but not sessionless http is stateless: there is no link between two requests being successively carried out on the same connection. this immediately has the prospect of being problematic for users a...
...ents, about what to cache and for how long. the client can instruct intermediate cache proxies to ignore the stored document. relaxing the origin constraint to prevent snooping and other privacy invasions, web browsers enforce strict separation between web sites. only pages from the same origin can access all the information of a web page. ...
... proxy and tunneling servers or clients are often located on intranets and hide their true ip address from other computers. http requests then go through proxies to cross this network barrier. not all proxies are http proxies. the socks protocol, for example, operates at a lower level. ...
...And 4 more matches

Fetch basic concepts - Web APIs
ore powerful and flexible feature set. this article explains some of the basic concepts of the fetch api. note: this article will be added to over time. if you find a fetch concept that you feel needs explaining better, let someone know on the mdn discussion forum, or mdn web docs room on matrix. in a nutshell at the heart of fetch are the interface abstractions of http requests, responses, headers, and body payloads, along with a global fetch method for initiating asynchronous resource requests. because the main components of http are abstracted as javascript objects, it is easy for other apis to make use of such functionality. service workers is an example of an api that makes heavy use of fetch. fetch takes the asynchronous nature of such requests one step further. the api is completel...
...method for initiating asynchronous resource requests. because the main components of http are abstracted as javascript objects, it is easy for other apis to make use of such functionality. service workers is an example of an api that makes heavy use of fetch. fetch takes the asynchronous nature of such requests one step further. the api is completely promise-based. ...
... apis to make use of such functionality. service workers is an example of an api that makes heavy use of fetch. fetch takes the asynchronous nature of such requests one step further. the api is completely promise-based. guard guard is a feature of headers objects, with possible values of immutable, request, request-no-cors, response, or none, depending on where the header is used. when a new headers object is created using the headers() constructor, its guard is set to none (the default). ...
...And 3 more matches

WindowOrWorkerGlobalScope.fetch() - Web APIs
browsers accept the blob: and data: schemes. a request object. init optional an object containing any custom settings that you want to apply to the request. the possible options are: method the request method, e.g., get, post. note that the origin header is not set on fetch requests with a method of head or get. (this behavior was corrected in firefox 65 — see bug 1508661). headers any headers you want to add to your request, contained within a headers object or an object literal with bytestring values. note that some names are forbidden. body any body that you want to add to your request: this can be a blob, buffersource, formdata, urlsearchparams, usvstring, or readablestream object. note that a request using the get or head method cannot have a body. mode the m...
...}); you could also pass the init object in with the request constructor to get the same effect: let myrequest = new request('flower...
...}); you could also pass the init object in with the request constructor to get the same effect: let myrequest = new request('flowers.jpg', myinit...
...And 3 more matches

request - Archive of obsolete content
nal options: name type url string,url this is the url to which the request will be made. can either be a string or an instance of the sdk's url. oncomplete function this function will be called when the request has received a response (or in terms of xhr, when readystate == 4). the function is passed a response object. headers object an unordered collection of name/value pairs representing headers to send with the request. content string,object the content to send to the server. if content is a string, it should be url-encoded (use encodeuricomponent). if content is an object, it should be a collection of name/value pairs. nested objects & arrays should encode safely. for get and...
...tin-1, use overridemimetype: var request = require("sdk/request").request; var quijote = request({ url: "http://www.latin1files.org/quijote.txt", overridemimetype: "text/plain; charset=latin1", oncomplete: function (response) { console.log(response.text); } }); quijote.get(); anonymous boolean if true, the request will be sent without cookies or authentication headers. ...
... once a request object has been created a get request can be executed by calling its get() method, a post request by calling its post() method, and so on. ...
...And 2 more matches

jspage - Archive of obsolete content
or(var d=0,c=1;1;d+=c,c/=2){if(f>=(7-4*d)/11){e=c*c-math.pow((11-6*d-11*f)/4,2); break;}}return e;},elastic:function(b,a){return math.pow(2,10*--b)*math.cos(20*b*math.pi*(a[0]||1)/3);}});["quad","cubic","quart","quint"].each(function(b,a){fx.transitions[b]=new fx.transition(function(c){return math.pow(c,[a+2]); });});var request=new class({implements:[chain,events,options],options:{url:"",data:"",headers:{"x-requested-with":"xmlhttprequest",accept:"text/javascript, text/html, application/xml, text/xml, */*"},async:true,format:false,method:"post",link:"ignore",issuccess:null,emulation:true,urlencoded:true,encoding:"utf-8",evalscripts:false,evalresponse:false,nocache:false},initialize:function(a){this.xhr=new browser.request(); this.setoptions(a);this.options.issuccess=this.options.issuccess||this.
...with":"xmlhttprequest",accept:"text/javascript, text/html, application/xml, text/xml, */*"},async:true,format:false,method:"post",link:"ignore",issuccess:null,emulation:true,urlencoded:true,encoding:"utf-8",evalscripts:false,evalresponse:false,nocache:false},initialize:function(a){this.xhr=new browser.request(); this.setoptions(a);this.options.issuccess=this.options.issuccess||this.issuccess;this.headers=new hash(this.options.headers);},onstatechange:function(){if(this.xhr.readystate!=4||!this.running){return; }this.running=false;this.status=0;$try(function(){this.status=this.xhr.status;}.bind(this));this.xhr.onreadystatechange=$empty;if(this.options.issuccess.call(this,this.status)){this.response={text:this.xhr.responsetext,xml:this.xhr.responsexml}; this.success(this.response.text,this.response...
...ontent-type"))){return $exec(a);}return a.stripscripts(this.options.evalscripts); },success:function(b,a){this.onsuccess(this.processscripts(b),a);},onsuccess:function(){this.fireevent("complete",arguments).fireevent("success",arguments).callchain(); },failure:function(){this.onfailure();},onfailure:function(){this.fireevent("complete").fireevent("failure",this.xhr);},setheader:function(a,b){this.headers.set(a,b); return this;},getheader:function(a){return $try(function(){return this.xhr.getresponseheader(a);}.bind(this));},check:function(){if(!this.running){return true; }switch(this.options.link){case"cancel":this.cancel();return true;case"chain":this.chain(this.caller.bind(this,arguments));return false;}return false;},send:function(k){if(!this.check(k)){return this; }this.running=true;var i=$ty...
...And 2 more matches

CORS-safelisted response header - MDN Web Docs Glossary: Definitions of Web-related terms
a cors-safelisted response header is an http header which has been safelisted so that it will not be filtered when responses are processed by cors, since they're considered safe (as the headers listed in access-control-expose-headers). ...
... a cors-safelisted response header is an http header which has been safelisted so that it will not be filtered when responses are processed by cors, since they're considered safe (as the headers listed in access-control-expose-headers). ...
...listed so that it will not be filtered when responses are processed by cors, since they're considered safe (as the headers listed in access-control-expose-headers). ...
...And 2 more matches

Eclipse CDT
by modifying the values of the following two lines in eclipse.ini: -xms1g -xmx5g if you fail to increase these limits, then you will likely find that eclipse either hangs when it tries to index the mozilla source or else that the code intelligence is very broken after the indexing "completes". express setup for the eclipse indexer to work well you must first build mozilla, so that it includes headers from the objdir etc. these can be found and processed by eclipse. note: your moz_objdir must be outside the mozilla source directory. once your build is complete, mach can then generate a useful eclipse project on your behalf. first, make sure that the directory of eclipse's eclipse binary (typically /applications/eclipse.app/contents/macos/ on macos) is in your path. then, to create the ecli...
...date breakpoints (breakpoints that you set during a previous debug session, after which you've since rebuilt). remove any such breakpoints and restart your debug session. known issues there are various known limitations and bugs when it comes to using eclipse with mozilla. eclipse is open source, of course so if anyone feels like doing a bit of java hacking to fix these issues that'd be great. headers are only parsed once for performance reasons, eclipse only processes header files that have include guards once, using the compiler options for the first source file it encounters that includes that header (eclipse bug 380511). this is responsible for most of the parse errors in the source files displayed in eclipse. one problem with the "parse once" strategy is that the compiler options for the...
...ssor macro" from the drop-down, and set name to _impl_ns_layout and leave value blank. finally, you'd click ok twice to return to the main eclipse window, and then use the context menu for the 'layout' directory to re-index the 'layout' directory, and then to "run c/c++ code analysis" on it to see if the problem is fixed. this "parse once" strategy can also cause "unresolved inclusion" errors in headers if the first time eclipse sees the header is while indexing a file for which it doesn't have any build output parser data. (since it then has no explicit include paths to search.) when this happens it frequently causes knock-on errors for the files that include that header (directly or indirectly), since they too now have things missing. people who have their object directory outside their source...
...And 2 more matches

Index
which you can implement in your code to monitor http transactions in real time, receiving a callback as the transactions take place. 72 observer notifications xpcom, xpcom:add-ons the following are topics that you can observe during the course of an application. unless otherwise noted you register for the topics using the nsiobserverservice. 73 setting http request headers add-ons, extensions, http, xul, xulrunner http is one of the core technologies behind the web. in addition to the actual content, some important information is passed with http headers for both http requests and responses. 74 storage guide, interfaces, storage, toolkit api storage is a sqlite database api. it is available to trusted callers, meaning extensions and f...
...eters for that request may be set by using the channel attributes, or by calling queryinterface() to retrieve a subclass of nsichannel for protocol-specific parameters. then, the uri can be fetched by calling open() or asyncopen(). after a request has been completed, the channel is still valid for accessing protocol-specific results. for example, queryinterfacing to nsihttpchannel allows response headers to be retrieved for the corresponding http transaction. 387 nsichanneleventsink channels, interfaces, interfaces:scriptable, xpcom, xpcom interface reference channels will try to get this interface from a channel's notificationcallbacks or, if not available there, from the loadgroup's notificationcallbacks. 388 nsichannelpolicy interfaces, interfaces:scriptable...
...h a http uri, for example: 682 nsihttpchannelinternal http, interfaces, interfaces:scriptable, xpcom, xpcom interface reference gets the request's major and minor version numbers. 683 nsihttpheadervisitor http, interfaces, interfaces:scriptable, xpcom, xpcom interface reference called by the nsihttpchannel implementation when visiting request and response headers. this method can throw an exception to terminate enumeration of the channel's headers. 684 nsihttpserver no summary! 685 nsihttpupgradelistener http, interfaces, interfaces:scriptable, reference, référence(2), xpcom interface reference this is used, for example, by websockets in order to upgrade an http channel to use the websocket protocol. 686...
...And 2 more matches

Using Service Workers - Web APIs
the resource whose url matches that of the network request, in each case: self.addeventlistener('fetch', (event) => { event.respondwith( caches.match(event.request) ); }); caches.match(event.request) allows us to match each resource requested from the network with the equivalent resource available in the cache, if there is a matching one available. the matching is done via url and vary headers, just like with normal http requests. let’s look at a few other options we have when defining our magic (see our fetch api documentation for more information about request and response objects.) the response() constructor allows you to create a custom response. in this case, we are just returning a simple text string: new response('hello from your friendly neighbourhood service worker...
... defining our magic (see our fetch api documentation for more information about request and response objects.) the response() constructor allows you to create a custom response. ...
...formation about request and response objects.) the response() constructor allows you to create a custom response. in this case, we are just returning a simple text string: new response('hello from your friendly neighbourhood service worker!'); this more complex response below shows that you can optionally pass a set of headers in with your response, emulating standard http response headers. ...
...And 2 more matches

Writing WebSocket servers - Web APIs
ld invoke a multiuser chat app, while /game on the same server might invoke a multiplayer game. client handshake request even though you're building a server, a client still has to start the websocket handshake process by contacting the server and requesting a websocket connection. so, you must know how to interpret the client's request. ...
...do whatever you want with those; they don't directly pertain to the websocket. it's also safe to ignore them. in many common setups, a reverse proxy has already dealt with them. tip: all browsers send an origin header. ...
...like this (the http version must be 1.1 or greater, and the method must be get): get /chat http/1.1 host: example.com:8000 upgrade: websocket connection: upgrade sec-websocket-key: dghlihnhbxbszsbub25jzq== sec-websocket-version: 13 the client can solicit extensions and/or subprotocols here; see miscellaneous for details. also, common headers like user-agent, referer, cookie, or authentication headers might be there as well. do whatever you want with those; they don't directly pertain to the websocket. it's also safe to ignore them. in many common setups, a reverse proxy has already dealt with them. tip: all browsers send an origin header. you can use this header for security (checking for same origin, automatically allowing or denying, etc.) and send a 403 forbidden if you don't like what y...
...And 2 more matches

XMLHttpRequest.readyState - Web APIs
the xmlhttprequest.readystate property returns the state an xmlhttprequest client is in. an xhr client exists in one of the following states: value state description 0 unsent client has been created. open() not called yet. 1 opened open() has been called. 2 headers_received send() has been called, and headers and status are available. 3 loading downloading; responsetext holds partial data. ...
... loading response's body is being received. if responsetype is "text" or empty string, responsetext will have the partial text response as it loads. ...
... loading response's body is being received. ...
...And 2 more matches

ARIA: row role - Accessibility
an element with role="row" is a row of cells within a tabular structure. a row contains one or more cells, grid cells or column headers, and possibly a row header, within a grid, table or treegrid, and optionally within a rowgroup. <div role="table" aria-label="populations" aria-describedby="country_population_desc"> <div id="country_population_desc">world populations by country</div> <div role="rowgroup"> <div role="row"> <span role="columnheader" aria-sort="descending">country</span> <span role="columnheader"aria-sort="none">population</span> </div> </div> <div role="rowgroup"> <div role="row"> <span role="cell">finland</span> <span role="cell">5.5 million</span> </div> <div role="row"> <span role="cell">fra...
...using native html <tr> elements, whenever possible, is strongly encouraged. to create an aria row, add role="row" to the container element. that row should be nested within a grid, table or treegrid. a group of rows can be nested within a grid, table or treegrid directly, or within a rowgroup in one of those containers. each row contains child ce...
...using native html <tr> elements, whenever possible, is strongly encouraged. to create an aria row, add role="row" to the container element. that row should be nested within a grid, table or treegrid. a group of rows can be nested within a grid, table or treegrid directly, or within a rowgroup in one of those containers. each row contains child cells. these cell...
...And 2 more matches

HTTP authentication - HTTP
then issue the request including the correct authorization header. in the case of a "basic" authentication like shown in the figure, the exchange must happen over an https (tls) connection to be secure. proxy authentication the same challenge and response mechanism can be used for proxy authentication. as both resource authentication and proxy authentication can coexist, a different set of headers and status codes is needed. in the case of proxies, the challenging status code is 407 (proxy authentication required), the proxy-authenticate response header contains at least one challenge applicable to the proxy, and the proxy-authorization request header is used for providing the credentials to the proxy server. access forbidden if a (proxy) server receives valid credentials that are inadeq...
...venting user credentials being stolen if attackers were able to embed an arbitrary image into a third-party page. character encoding of http authentication browsers use utf-8 encoding for usernames and passwords. firefox once used iso-8859-1, but changed to utf-8 for parity with other browsers and to avoid potential problems as described in bug 1419658. ...
...o embed an arbitrary image into a third-party page. character encoding of http authentication browsers use utf-8 encoding for usernames and passwords. firefox once used iso-8859-1, but changed to utf-8 for parity with other browsers and to avoid potential problems as described in bug 1419658. ...
...And 2 more matches

Planned changes to shared memory - JavaScript
ion between sites and help reduce the impact of attacks with high-resolution timers, which can be created with shared memory. starting with firefox 79, the features described in this document are enabled by default. chrome intends to implement similar restrictions. new http header bonanza as a baseline requirement, documents will need to be in a secure context. for top-level documents, two headers will need to be set: cross-origin-opener-policy with same-origin as value (protects your origin from attackers) cross-origin-embedder-policy with require-corp as value (protects victims from your origin) with these two headers set, postmessage() will no longer throw for sharedarraybuffer objects and shared memory across threads is therefore available. nested documents and dedicated workers...
...origin as value. note that setting the cross-origin-resource-policy header to any other value than same-origin opens up the resource to potential attacks, such as spectre. note that the cross-origin-opener-policy header limits your ability to retain a reference to popups. direct access between two top-level window contexts will essentially only work if they are same-origin and carry the same two headers with the same two values. api changes as a result of this newly required environment, there are a couple api implications: the atomics object is always available. sharedarraybuffer objects are in principle always available, but unfortunately the constructor on the global object is hidden, unless the two headers mentioned above are set, for compatibility with web content. there is hope that ...
...ions: the atomics object is always available. sharedarraybuffer objects are in principle always available, but unfortunately the constructor on the global object is hidden, unless the two headers mentioned above are set, for compatibility with web content. there is hope that this restriction can be removed in the future. webassembly.memory can still be used to get an instance. unless the two headers mentioned above are set, the various postmessage() apis will throw for sharedarraybuffer objects. ...
...And 2 more matches

Entity header - MDN Web Docs Glossary: Definitions of Web-related terms
an entity header is an http header that can be used in an http request or response, and describes the content of the body of themessage. headers like content-length, content-language, content-encoding are entities headers. even if they are neither request, nor response headers, entity headers are often included in such terms. ...
... an entity header is an http header that can be used in an http request or response, and describes the content of the body of themessage. headers like content-length, content-language, content-encoding are entities headers. even if they are neither request, nor response headers, entity headers are often included in such terms. ...
...esponse, and describes the content of the body of themessage. headers like content-length, content-language, content-encoding are entities headers. even if they are neither request, nor response headers, entity headers are often included in such terms. ...
...ed in such terms. ...

HTTP header - MDN Web Docs Glossary: Definitions of Web-related terms
an http header is a field of an http request or response that passes additional information, altering or precising the semantics of the message or of the body. headers are case-insensitive, begins at the start of a line and are immediately followed by a ':' and a value depending of the header itself. the value finish at the next crlf or at the end of the message. traditionally, headers are classed in categories, though this classification is no more part of any specification: general header: headers applying to both requests and responses but with no relation to the data eventually transmitted in the body. ...
...tely followed by a ':' and a value depending of the header itself. the value finish at the next crlf or at the end of the message. traditionally, headers are classed in categories, though this classification is no more part of any specification: general header: headers applying to both requests and responses but with no relation to the data eventually transmitted in the body. request header: headers containing more information about the resource to be fetched or about the client itself. response header: headers with additional information about the response, like its location or about the server itself (name, version, …). entity header: headers containing more information about the body of the entity, like its content length or its mime-type. a basic request with one header: get /exam...
...r about the client itself. response header: headers with additional information about the response, like its location or about the server itself (name, version, …). entity header: headers containing more information about the body of the entity, like its content length or its mime-type. ...
...mation about the response, like its location or about the server itself (name, version, …). entity header: headers containing more information about the body of the entity, like its content length or its mime-type. ...

Request header - MDN Web Docs Glossary: Definitions of Web-related terms
a request header is an http header that can be used in an http request, and that doesn't relate to the content of the message. request headers, like accept, accept-*, or if-* allow to perform conditional requests; others like cookie, user-agent, or referer precise the context so that the server can tailor the answer. not all headers appearing in a request are request headers. for example, the content-length appearing in a post request is actually an entity header referring to the size of the body of the request message. however, these entity headers are often called request headers in such a context. ...
... precise the context so that the server can tailor the answer. not all headers appearing in a request are request headers. for example, the content-length appearing in a post request is actually an entity header referring to the size of the body of the request message. however, these entity headers are often called request headers in such a context. in addition, cors defines a subset of request headers as simple headers, request headers that are always considered authorized and are not explicitly listed in responses to preflight requests. ...
...ing in a post request is actually an entity header referring to the size of the body of the request message. however, these entity headers are often called request headers in such a context. in addition, cors defines a subset of request headers as simple headers, request headers that are always considered authorized and are not explicitly listed in responses to preflight requests. ...
...b8b0fff2a9199f722e3a621a" cache-control: max-age=0 strictly speaking, the content-length header in this example is not a request header like the others, but an entity header: post /myform.html http/1.1 host: developer.mozilla.org user-agent: mozilla/5.0 (macintosh; intel mac os x 10.9; rv:50.0) gecko/20100101 firefox/50.0 content-length: 128 learn more technical knowledge list of all http headers ...

Assessment: Structuring planet data - Learn web development
anets-data.txt file. if you have trouble visualising the data, look at the live example above, or try drawing a diagram. open your copy of blank-template.html, and start the table off by giving it an outer container, a table header, and a table body. you don't need a table footer for this example. add the provided caption to your table. add a row to the table header containing all the column headers. ...
... hints and tips the first cell of the header row needs to be blank, and span two columns. the group row headings (e.g. ...
...adings into headings semantically. ensure all the content is placed into the right cells — in the raw data, each row of planet data is shown next to its associated planet. add attributes to make the row and column headers unambiguously associated with the rows, columns, or rowgroups that they act as headings for. add a black border just around the column that contains all the planet name row headers. hints and tips the first cell of the header row needs to be blank, and span two columns. the group row headings (e.g. ...
... assessment or further help if you would like your work assessed, or are stuck and want to ask for help: put your work into an online shareable editor such as codepen, jsfiddle, or glitch. write a post asking for assessment and/or help at the mdn discourse forum learning category. ...

Handling common accessibility problems - Learn web development
— there is no way for a screen reader user to associate rows or columns together as groupings of data — to do this you need to know what the header rows are, and if they are heading up rows, columns, etc. this can only be done visually for such a table. if you instead look at our punk-bands-complete.html example (live, source), you can see a few accessibility aids at work here, such as table headers (<th> and scope attributes), <caption> element, etc. note: for more information about accessible tables, read accessible data tables. css css tends to provide a lot fewer fundamental accessibility features than html, but it can still do just as much damage to accessibility if used incorrectly. we have already mentioned a couple of accessibility tips involving css: use the correct semantic...
...t of a group. vo + c (when inside a table) read the header of the current column. vo + r (when inside a table) read the header of the current row. vo + c + c (two cs in succession) (when inside a table) read the entire current column, including header. vo + r + r (two rs in succession) (when inside a table) read the entire current row, including the headers that correspond to each cell. vo + left cursor, vo + right cursor (when inside some horizontal options, such as a date or time picker) move between options. vo + up cursor, vo + down cursor (when inside some horizontal options, such as a date or time picker) change the current option. vo + u use the rotor, which displays lists of headings, links, form controls,...
...r (when inside form) select chosen value. ctrl + alt + cursor keys (when a table is selected) move between table cells. screenreader testing now you've gotten used to using a screenreader, we'd like you to use it to do some quick accessibility tests, to get an idea of how screenreaders deal with good and bad webpage features: look at good-semantics.html, and note how the headers are found by the screenreader and available to use for navigation. now look at bad-semantics.html, and note how the screenreader gets none of this information. imagine how annoying this would be when trying to navigate a really long page of text. look at good-links.html, and note how they make sense when viewed out of context. this is not the case with bad-links.html — they are all just "click...
... "click here". look at good-form.html, and note how the form inputs are described using their labels because we've used <label> elements properly. in bad-form.html, they get an unhelpful label along the lines of "blank". look at our punk-bands-complete.html example, and see how the screenreader is able to associate columns and rows of content and read them out all together because we've defined headers properly. in bad-table.html, none of the cells can be associated at all. note that nvda seems to behave slightly stragely when you've only got a single table on a page; you could try webaim's table test page instead. have a look at the wai-aria live regions example we saw earlier, and note how the screen reader will keep reading out the constantly updating section as it updates. user testing ...

Makefile - variables
ce files to compile. defines additional preprocessor defines for c++ expand_mozlibname exports a list of exported header files and sources to install for external use. exports_namespaces exported package include directory: dist/include/${namespace} exports_${namespace} a list of exports/headers that should be copied into the exported namespace directory. extra_components nsdefaultclh.manifest, javascript xpcomm files extra_dso_libs extra_dso_ldopts extra_js_modules extra_pp_components xpcomm files to pre-process before installation. garbage a "clean t...
... module_name no_dist_install inhibit generating and copying exports/install targets into $(moz_objdir)/dist/install. .ns_printing objs obj_suffix filename suffix to use when writing object files. module instructs the build system where to install exported headers. simple_programs suppress_default_rules inhibit processing of makefile tier targets/directory processing will be unordered. tier build order dependencies - subdirectories for make to traverse prior to building current. xpidl_module module name to use when generating .xpt files, default to module. ...
...t_rules inhibit processing of makefile tier targets/directory processing will be unordered. tier build order dependencies - subdirectories for make to traverse prior to building current. xpidl_module module name to use when generating .xpt files, default to module. xpidlsrcs internal: a list of .idl files to generate exported headers from. xpidl_name name of extension to build see also configure.sh variables description build_project_arg command line/environment override configure_env_args command line/environment override directory variable dirs a list of subdirecto...
... gnu_cc defined if the gnu gcc compiler is available. module_optimize_flags additional flags for enabling or overriding compiler optimizations(-o2). solaris_sunpro_cc sun studio compiler export variables description autocfg_js_exports exports a list of exported headers and source files for external use. has_extra_exports pref_js_exports javascript preferences file to export[1]. sdk_headers makefile generation description no_makefile_rule [pending] inhibit makefile.in deps that would allow $obj/makefile to be generated. ...

Http.jsm
method get, post or put (this is automatically set if postdata exists). ...
... method get, post or put (this is automatically set if postdata exists). ...
...ly set if postdata exists). onload a function handle to call when the load is complete, it takes two parameters: the responsetext and the xhr object. onerror a function handle to call when an error occurs, it takes three parameters: the error, the responsetext and the xhr object. logger an object that implements the debug and log methods (e.g. log.jsm). headers or post data are given as an array of arrays, for each inner array the first value is the key and the second is the value. for example: [["key1", "value1"], ["key2", "value2"]]. submitting post data httprequest allows attaching data to the post requests. the data can be specified via postdata option. postdata can be of 2 different types: a string or an array of parameters. when null/undefined i...
... as an array of key-value pairs. the elements of the array will be url-encoded and "application/x-www-form-urlencoded; charset=utf-8" will be enforced as the content type. http.jsm only forces the content type if the post data is an array, and it serializes it automatically. if the provided postdata is a string, the content type isn't touched. in this case, the content type may be set through the headers parameter. additional xhr configuration it is possible to modify things manually on the xhr object after calling httprequest. httprequest returns an xhr object, which can be used to set additional parameters for the request. for example, xhr might be configured to use any custom mime-type when processing a response regardless of what the server returns. to achieve this, you can obtain an xhr ob...

Enc Dec MAC Output Public Key as CSR
nss sample code 5: encryption/decryption and mac and output public as a csr. generates encryption/mac keys and outputs public key as certificate signing request /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... public as a csr. generates encryption/mac keys and outputs public key as certificate signing request /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...; case lab: header = lab_header; trailer = lab_trailer; break; default: pr_close(file); return secfailure; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ char *trail = null; if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { ...
...f (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; } else { pr_fprintf(pr_stderr, "input has header but no trailer\n"); port_free(filedata.data); return secfailure; } } else { /* headers didn't exist */ body = nonbody; if (body) { trail = strstr(++body, trailer); if (trail != null) { pr_fprintf(pr_stderr, "input has no header but has trailer\n"); port_free(filedata.data); return secfailure; } } } cleanup: pr_close(file); atob_convertasciitoi...

Enc Dec MAC Using Key Wrap CertReq PKCS10 CSR
nss sample code 6: encryption/decryption and mac and output public as a pkcs 11 csr. generates encryption/mac keys and outputs public key as pkcs11 certificate signing request /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...ng request /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... header = ns_sig_header; trailer = ns_sig_trailer; break; default: rv = secfailure; goto cleanup; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0...
...rchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; } else { pr_fprintf(pr_stderr, "input has header but no trailer\n"); port_free(filedata.data); rv = secfailure; goto cleanup; } } else { /* headers didn't exist */ char *trail = null; body = nonbody; if (body) { trail = strstr(++body, trailer); if (trail != null) { pr_fprintf(pr_stderr, "input has no header but has trailer\n"); port_free(filedata.data); rv = secfailure; goto cleanup; } } } ...

NSS Sample Code Sample_3_Basic Encryption and MACing
nss sample code 3: basic encryption and macing this example program demonstrates how to encrypt and mac a file. ...
... nss sample code 3: basic encryption and macing this example program demonstrates how to encrypt and mac a file. ...
...me>.enc and <ipfilename>.header\n", ""); fprintf(stderr, "%-7s as input files and produces <opfilename> as a final output file.\n\n", ""); exit(-1); } /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... strcpy(trailer, mac_trailer); break; case pad: strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; ...

sample2
/* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
..._trailer; break; case certvfy: header = ns_cert_vfy_header; trailer = ns_cert_vfy_trailer; break; case sig: header = ns_sig_header; trailer = ns_sig_trailer; break; default: rv = secfailure; goto cleanup; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; } else { pr_fprintf(pr_stderr, "input has header but no trailer\n"); port_free(filedata.data); ...
...strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; } else { pr_fprintf(pr_stderr, "input has header but no trailer\n"); port_free(filedata.data); rv = secfailure; goto cleanup; } } else { /* headers didn't exist */ char *trail = null; body = nonbody; if (body) { trail = strstr(++body, trailer); if (trail != null) { pr_fprintf(pr_stderr, "input has no header but has trailer\n"); port_free(filedata.data); rv = secfailure; goto cleanup; } } } hextobuf(body, item, ishexdata); cleanup: if (file) { pr_close(file); } return rv; } /* * generate the private key */ seckeyprivatekey * generateprivateke...

nsIMsgMessageService
acopylistener alre...
...this is for consumers who want a particular header but don't want to stream the whole message. nsiuri streammessage(in string amessageuri, in nsistreamlistener aconsumer, in nsiurllistener aurllistener, in boolean alocalonly); parameters amessageuri uri o...
...siscriptableinputstream); scriptinputstream.init(consumer); try { msgservice.streammessage(messageuri, msgstream, msgwindow, null, false, null); } catch (ex) { alert("error: "+ex) } scriptinputstream .available(); while (scriptinputstream .available()) { content = content + scriptinputstream .read(512); } alert(content streamheaders() this method streams a message's headers to the passed in consumer. this is for consumers who want a particular header but don't want to stream the whole message. nsiuri streammessage(in string amessageuri, in nsistreamlistener aconsumer, in nsiurllistener aurllistener, in boolean alocalonly); parameters amessageuri uri of message to stream aconsumer nsistreamli...
...particular header but don't want to stream the whole message. nsiuri streammessage(in string amessageuri, in nsistreamlistener aconsumer, in nsiurllistener aurllistener, in boolean alocalonly); parameters amessageuri uri of message to stream aconsumer nsistreamlistener generally, a stream listener listening to the message headers. the consumer has to be a stream listener and in your listener's ondataavailable method, you can write out the stream data to a local file or concatenate it to a string. aurllistener an nsiurllistener that is notified when url starts and stops, if we run a url. alocalonly whether data should be retrieved only from local caches. if streaming over the network is required and this is true, th...

Index
it. as such, i've always thought it would be nice to have a list of what xul, js, or other files are that are here, what they do, and where they overlay at different points within the client. things appear confusing for several reasons: 45 message interfaces interfaces, interfaces:scriptable, needscontent, xpcom api reference, thunderbird nsimsghdr - this interface describes headers for all mail messages. it can be used to retrieve address, subject and related header information for a mail message. 46 message examples thunderbird no summary! 47 message list examples thunderbird no summary! 48 message list interfaces thunderbird no summary! 50 spam filtering seth spitzer the mozilla implem...
...red in a binary format, in a file named "training.dat". initially, the training.dat file is empty (there was discussion of shipping with a default file) on spam detection, the user can choose to move spam to a special "junk" folder the user can configure junk mail can be automatically purged from the "junk" folder to analyze a message for spam, we need the entire message, not just the headers. spam detection happens after filters are run white listing happens after filters, but before spam detection the purge code is implemented as a search of the "junk" folder, looking for "old" message that have the proper junk status. when does purging happens? elaborate on the mime changes that were made for spam currently, spam filtering is does not work for news, but it would b...
...t: 99 add tab needsupdate, missing, thunderbird this page has no content. enrich mdc by contributing. 100 add toolbar button example xul overlay file: 101 create custom column thunderbird the article "creating a custom column" will get you well on the road to creating your own columns and populating them with custom data. the customdbheaders preference article provides information on a preference setting that exposes custom header data for use in a custom column within thunderbird's main view. 102 detect opening folder thunderbird some actions require execution every time you open a folder (for example, registering a custom column handler. to do this you need to capture the select event of the folder [[xul:tree|t...
...e" refers to the main navigation element that appears on the left side of the main thunderbird window. here, users traditionally find a hierarchical view of their accounts and folders. beginning in thunderbird 2, additional views on those folders ("recent folders", "favorite folders", and "unread folders") were added, accessible via the scroll-arrows at the top of the pane. 112 customdbheaders preference developing a custom column to display a 'superfluous' column within thunderbird's main view. the data will come from a custom header labeled x-superfluous 114 using mapi with thunderbird's windows 7 developer builds thunderbird debug, thunderbird mapi (messaging application programming interface) is a windows feature that allows applications to send file...

Cache - Web APIs
for an origin. make sure to version caches by name and use the caches only from the version of the script that they can safely operate on. see deleting old caches for more information. note: the key matching algorithm depends on the vary header in the value. so matching a new key requires looking at both key and value for entries in the cache. note: the caching api doesn't honor http caching headers. methods cache.match(request, options) returns a promise that resolves to the response associated with the first matching request in the cache object. cache.matchall(request, options) returns a promise that resolves to an array of all matching requests in the cache object. cache.add(request) takes a url, retrieves it and adds the resulting response object to the given cache. this is fun...
...l to cache.put() later on. // both fetch() and cache.put() "consume" the request, so we need to make a copy. // (see /docs/web/api/request/clone) return fetch(event.request.clone()).then(function(response) { console.log(' response for %s from network is: %o', event.request.url, response); if (response.status < 400 && response.headers.has('content-type') && response.headers.get('content-type').match(/^font\//i)) { // this avoids caching responses that we know are errors (i.e. http status code of 4xx or 5xx). // we also only want to cache responses that correspond to fonts, // i.e. have a content-type response header that starts with "font/". // note that for opaque ...
...esponses that we know are errors (i.e. http status code of 4xx or 5xx). // we also only want to cache responses that correspond to fonts, // i.e. have a content-type response header that starts with "font/". // note that for opaque filtered responses (https://fetch.spec.whatwg.org/#concept-filtered-response-opaque) // we can't access to the response headers, so this check will always fail and the font won't be cached. // all of the google web fonts are served off of a domain that supports cors, so that isn't an issue here. // it is something to keep in mind if you're attempting to cache other resources from a cross-origin // domain that doesn't support cors, though! // we call .clone() on the response ...
...ns that arise from the match() or fetch() operations. // note that a http error response (e.g. 404) will not trigger an exception. // it will return a normal response object that has the appropriate error code set. console.error(' error in fetch handler:', error); throw error; }); }) ); }); storing cookies in caches the fetch api requires set-cookie headers to be stripped before returning a response object from fetch(). so a response stored in a cache won't contain headers. specifications specification status comment service workersthe definition of 'cache' in that specification. working draft initial definition. ...

ARIA: rowgroup role - Accessibility
an element with role="rowgroup" is a group of rows within a tabular structure. a rowgroup contains one or more rows of cells, grid cells, column headers, or row headers within a grid, table or treegrid. <div role="table" aria-label="populations" aria-describedby="country_population_desc"> <div id="country_population_desc">world populations by country</div> <div role="rowgroup"> <div role="row"> <span role="columnheader" aria-sort="descending">country</span> <span role="columnheader"aria-sort="none">population</span> </div> </div> <div role="rowgroup"> <div role="row"> <span role="cell">finland</span> <span role="cell">5.5 million</span> </div> <div role="row"> <span role="cell">france</span> <span role...
..., and <tbody> html elements, whenever possible, is strongly encouraged. to create an aria table header, table footer or table body, add role="rowgroup" to the element. that rowgroup should be nested within a grid, table or treegrid, encompassing a group of one or more rows. each row, in turn, contains child cells. these cells can be of different types, depending on whether they are column or row headers, or plain or grid cells. note: using the native html table element (<table>) along with the table header (<thead>), footer (<tfoot>), and body (<tbody>) elements whenever possible is strongly encouraged. associated wai-aria roles, states, and properties context roles role="table" one of the three possible contexts (along with grid and treegrid) in which you'll find a row. it identifies...
...he row as being part of a non-interactive table structure containing data arranged in rows and columns, similar to the native <table> html element. role="treegrid" similar to a grid, but with rows that can be expanded and collapsed in the same manner as for a tree. descendant roles role="row" a row of cells within a tabular structure. a row contains one or more cells, gridcell, or column headers, and sometimes a row header. keyboard interactions none required javascript features none. the first rule of aria use is if you can use a native feature with the semantics and behavior you require already built in, instead of re-purposing an element and adding an aria role, state or property to make it accessible, then do so. employ the html <table> element instead of the aria role of tabl...
...ead</span> </div> <div role="row" aria-rowindex="24"> <span role="cell">term</span> <span role="cell">dt</span> </div> </div> </div> the above is a non-semantic aria table with a table header and table body, with five of 81 rows present in the dom: one within a table header and four rows within the table body. the header row, alone in a header rowgroup, has two column headers. the columns are sortable, but not currently sorted, as indicated by the aria-sort property. the table body is a separate rowgroup, with four rows currently in the dom. because not all the rows are in the dom, we've included the aria-rowindex property on every row. best practices only use table, tbody, thead, tr, th, td, and so on for data table structure. you can add these aria roles to ensure...

<table>: The Table element - HTML: Hypertext Markup Language
38, 90%, 65%, 1)</code></td> <td><code>rgba(246, 188, 87, 1)</code></td> </tr> </tbody> </table> providing a declaration of scope="col" on a <th> element will help describe that the cell is at the top of a column. providing a declaration of scope="row" on a <th> element will help describe that the cell is the first in a row. ...
... </tr> </tbody> </table> providing a declaration of scope="col" on a <th> element will help describe that the cell is at the top of a column. providing a declaration of scope="row" on a <th> element will help describe that the cell is the first in a row. mdn tables for visually impaired users tables with two headers • tables • w3c wai web accessibility tutorials tables with irregular headers • tables • w3c wai web accessibility tutorials h63: using the scope attribute to associate header cells and data cells in data tables | w3c techniques for wcag 2.0 complicated tables assistive technology such as screen readers may have difficulty parsing tables that are so complex that header cells can’t be associated in a strictly horizontal or vertical way. this is typically indicated...
...on of smaller, related tables that don't have to rely on using the colspan and rowspan attributes. in addition to helping people who use assistive technology understand the table's content, this may also benefit people with cognitive concerns who may have difficulty understanding the associations the table layout is describing. ...
... content, this may also benefit people with cognitive concerns who may have difficulty understanding the associations the table layout is describing. if the table cannot be broken apart, use a combination of the id and headers attributes to programmatically associate each table cell with the header(s) the cell is associated with. mdn tables for visually impaired users tables with multi-level headers • tables • w3c wai web accessibility tutorials h43: using id and headers attributes to associate data cells with header cells in data tables | techniques for w3c wcag 2.0 specifications specification status comment html living standardthe definition of 'table element' in that specification. living standard html5the definition of 'table element' ...

OPTIONS - HTTP
n cors in cors, a preflight request is sent with the options method so that the server can respond if it is acceptable to send the request. in this example, we will request permission for these parameters: the access-control-request-method header sent in the preflight request tells the server that when the actual request is sent, it will have a post request method. the access-control-request-headers header tells the server that when the actual request is sent, it will have the x-pingother and content-type headers. options /resources/post-here/ http/1.1 host: bar.example accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 accept-language: en-us,en;q=0.5 accept-encoding: gzip,deflate connection: keep-alive origin: https://foo.example access-control-request-method: post ac...
...ver that when the actual request is sent, it will have the x-pingother and content-type headers. options /resources/post-here/ http/1.1 host: bar.example accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 accept-language: en-us,en;q=0.5 accept-encoding: gzip,deflate connection: keep-alive origin: https://foo.example access-control-request-method: post access-control-request-headers: x-pingother, content-type the server now can respond if it will accept a request under these circumstances. in this example, the server response says that: access-control-allow-origin the https://foo.example origin is permitted to request the bar.example/resources/post-here/ url via the following: access-control-allow-methods post, get, and options are permitted methods for the url. (this...
...circumstances. in this example, the server response says that: access-control-allow-origin the https://foo.example origin is permitted to request the bar.example/resources/post-here/ url via the following: access-control-allow-methods post, get, and options are permitted methods for the url. (this header is similar to the allow response header, but used only for cors.) access-control-allow-headers any script inspecting the response is permitted to read the values of the x-pingother and content-type headers. access-control-max-age the above permissions may be cached for 86,400 seconds (1 day). http/1.1 204 no content date: mon, 01 dec 2008 01:15:39 gmt server: apache/2.0.61 (unix) access-control-allow-origin: https://foo.example access-control-allow-methods: post, get, options access-c...
...inspecting the response is permitted to read the values of the x-pingother and content-type headers. access-control-max-age the above permissions may be cached for 86,400 seconds (1 day). ...

Protocol upgrade mechanism - HTTP
d is used by clients to invite the server to switch to one of the listed protocols, in descending preference order. because upgrade is a hop-by-hop header, it also needs to be listed in the connection header field. this means that a typical request that includes upgrade would look something like: get /index.html http/1.1 host: www.example.com connection: upgrade upgrade: example/1, foo/2 other headers may be required depending on the requested protocol; for example, websocket upgrades allow additional headers to configure details about the websocket connection as well as to offer a degree of security in opening the connection. see upgrading to a websocket connection for more details. if the server decides to upgrade the connection, it sends back a 101 switching protocols response status with ...
...ction then handling the handshaking and upgrade process for you. you can also use the "wss://" url scheme to open a secure websocket connection. if you need to create a websocket connection from scratch, you'll have to handle the handshaking process yourself. after creating the initial http/1.1 session, you need to request the upgrade by adding to a standard request the upgrade and connection headers, as follows: connection: upgrade upgrade: websocket websocket-specific headers the following headers are involved in the websocket upgrade process. other than the upgrade and connection headers, the rest are generally optional or handled for you by the browser and server when they're talking to each other. sec-websocket-extensions specifies one or more protocol-level websocket extensions to ...
... communicating with the server. this number should be the most recent version possible listed in the iana websocket version number registry. the most recent final version of the websocket protocol is version 13. ...
...ludes in its headers a sec-websocket-version header with a comma-separated list of the supported protocol versions. if the server does support the requested protocol version, no sec-websocket-version header is included in the response. sec-websocket-version: supportedversions supportedversions a comma-delineated list of the websocket protocol versions supported by the server. response-only headers the response from the server may include these. sec-websocket-accept included in the response message from the server during the opening handshake process when the server is willing to initiate a websocket connection. it will appear no more than once in the response headers. sec-websocket-accept: hash hash if a sec-websocket-key header was provided, the value of this header is computed by...

431 Request Header Fields Too Large - HTTP
this lets users attempt to fix the problem, such as by clearing their cookies. ...
...this lets users attempt to fix the problem, such as by clearing their cookies. ...
...this lets users attempt to fix the problem, such as by clearing their cookies. ...
...this lets users attempt to fix the problem, such as by clearing their cookies. ...

HTTP response status codes - HTTP
le yet. 103 early hints this status code is primarily intended to be used with the link header, letting the user agent start preloading resources while the server prepares a response. successful responses 200 ok the request has succeeded. the meaning of the success depends on the http method: get: the resource has been fetched and is transmitted in the message body. head: the entity headers are in the message body. put or post: the resource describing the result of the action is transmitted in the message body. trace: the message body contains the request message as received by the server 201 created the request has succeeded and a new resource has been created as a result. this is typically the response sent after post requests, or some put requests. 202 accepted the re...
...formation this response code means the returned meta-information is not exactly the same as is available from the origin server, but is collected from a local or a third-party copy. this is mostly used for mirrors or backups of another resource. except for that specific case, the "200 ok" response is preferred to this status. 204 no content there is no content to send for this request, but the headers may be useful. the user-agent may update its cached headers for this resource with the new ones. 205 reset content tells the user-agent to reset the document which sent this request. 206 partial content this response code is used when the range header is sent from the client to request only part of a resource. 207 multi-status (webdav) conveys information about multiple resources, for situa...
...ttp specification intends this status code to be used for "limited-time, promotional services". apis should not feel compelled to indicate resources that have been deleted with this status code. 411 length required server rejected the request because the content-length header field is not defined and the server requires it. 412 precondition failed the client has indicated preconditions in its headers which the server does not meet. 413 payload too large request entity is larger than limits defined by server; the server might close the connection or return an retry-after header field. 414 uri too long the uri requested by the client is longer than the server is willing to interpret. 415 unsupported media type the media format of the requested data is not supported by the server, so the s...
...ses are a server that is down for maintenance or that is overloaded. note that together with this response, a user-friendly page explaining the problem should be sent. this responses should be used for temporary conditions and the retry-after: http header should, if possible, contain the estimated time before the recovery of the service. the webmaster must also take care about the caching-related headers that are sent along with this response, as these temporary condition responses should usually not be cached. 504 gateway timeout this error response is given when the server is acting as a gateway and cannot get a response in time. 505 http version not supported the http version used in the request is not supported by the server. 506 variant also negotiates the server has an internal config...

Getting started - SVG: Scalable Vector Graphics
oad gzip-compressed svg from the local computer. avoid gzip-compressed svg except when you are publishing to a webserver that you know will serve it correctly (see below). a word on webservers now that you have an idea of how to create basic svg files, the next stage is to upload them to a webserver. there are some gotchas at this stage though. for normal svg files, servers should send the http headers: content-type: image/svg+xml vary: accept-encoding for gzip-compressed svg files, servers should send the http headers: content-type: image/svg+xml content-encoding: gzip vary: accept-encoding you can check that your server is sending the correct http headers with your svg files by using the network monitor panel or a site such as websniffer.cc. submit the url of one of your svg files and loo...
...if you have problems convincing them to correctly configure their servers for svg, there may be ways to do it yourself. ...
...if you have problems convincing them to correctly configure their servers for svg, there may be ways to do it yourself. see the server configuration page on the w3.org for a range of simple solutions. ...
...e, then you should contact your web host. if you have problems convincing them to correctly configure their servers for svg, there may be ways to do it yourself. see the server configuration page on the w3.org for a range of simple solutions. server misconfiguration is a very common reason for svg failing to load, so make sure you check yours. if your server is not configured to send the correct headers with the svg files it serves, then firefox will most likely show the markup of the files as text or encoded garbage, or even ask the viewer to choose an application to open them. « previousnext » ...

Promises - Archive of obsolete content
d = event => resolve(event.target); xhr.onerror = reject; let defaultmethod = options.data ? ...
... let defaultmethod = options.data ? ...
...ata).constructor.name == "object") { options.data = new formdata; for (let key of object.keys(data)) options.data.append(key, data[key]); } xhr.send(options.data); }); } example usage: task.spawn(function* () { let request = yield request("http://example.com/", { method: "put", mimetype: "application/json", headers: { "x-species": "hobbit" }, data: { foo: new file(path), thing: "stuff" }, responsetype: "json" }); console.log(request.response["json-key"]); }); ...

Compiling The npruntime Sample Plugin in Visual Studio - Archive of obsolete content
project) copy the npruntime sample plugin source code into the dir of the new vs project and add the files to the project using the vs gui (.cpp files to "source files", .h files to "header files", .rc file to "resource files"). samples can be obtained from: https://developer.mozilla.org/en/plugins/samples_and_test_cases get the npapi sdk. ...
...they may be already disabled. define the function exports by adding the .def filename (e.g. nprt.def) to project properties|(all configurations)|linker|input|module definition file. it could be either the full path or the path relative to the project directory. ...
...they may be already disabled. ...

Microsummary topics - Archive of obsolete content
summarizing that page, check for the presence and value of the x-moz request header. if the x-moz header is present, and its value is microsummary, then the request is a microsummary-related request. otherwise, it is a user-initiated request. controlling the frequency of microsummary requests when firefox downloads content in order to update a microsummary, it honors cache-related http response headers. thus, if you would like to control how frequently firefox initiates microsummary-related requests to your web server, you can do so by including an http expires or cache-control header in your response to a microsummary-related request. for example, you might include the following header in your response to prevent firefox from making another microsummary-related request for one hour: cache-cont...
...ader in your response to a microsummary-related request. for example, you might include the following header in your response to prevent firefox from making another microsummary-related request for one hour: cache-control: max-age=3600 note: because of a technical limitation (bug 346820), firefox uses the same cache for both microsummary-related requests and user-initiated requests, so the cache headers you return apply to both. thus if your cache headers tell firefox not to refresh a page on your site more than once per hour, and the user reloads the page within that time period, the user will see the cached version of your page, which may not be what you want. to mitigate this effect, only return microsummary-specific cache headers in response to microsummary-related requests. then only micros...
... cache headers tell firefox not to refresh a page on your site more than once per hour, and the user reloads the page within that time period, the user will see the cached version of your page, which may not be what you want. to mitigate this effect, only return microsummary-specific cache headers in response to microsummary-related requests. then only microsummary users will be affected by those headers. ...

Accessibility/XUL Accessibility Reference - Archive of obsolete content
the main tree is accessible like a regular tree control. firefox exposes the position, cardinality, and depth of each tree item thr...
... the main tree is accessible like a regular tree control. firefox exposes the position, cardinality, and depth of each tree item through the accessible des...
... the main tree is accessible like a regular tree control. ...

NPStream - Archive of obsolete content
summary represents a stream of data either produced by the browser and consumed by the plug-in, or produced by the plug-in and consumed by the browser. syntax typedef struct _npstream { void* pdata; /* plug-in private data */ void* ndata; /* netscape private data */ const char* url; uint32 end; uint32 lastmodified; void* notifydata; const char *headers; } npstream; fields the data structure has the following fields: plug-in-private value that the plug-in can use to store a pointer to private data associated with the instance; not modified by the browser. ndata browser-private value that can store data associated with the instance; should not be modified by the plug-in. url the url that the data in the stream is read from or written to. end ...
...ified time the data in the url was last modified (if applicable), measured in seconds since 12:00 midnight gmt, january 1, 1970. notifydata used only for streams generated in response to a npn_geturlnotify or npn_posturlnotify request. for these streams, notifydata is set to the value of the notifydata parameter to npn_geturlnotify or npn_posturlnotify. for other streams, notifydata is null. headers the response headers from the host. this field is only available if the np version is greater than or equal to npvers_has_response_headers. this field is used only for http and is null for other types of streams. the plug-in should copy this data before making use of it. the headers include the http status line and all headers, verbatim as received from the server. lines are terminated by newline...
... description the browser allocates and initializes the npstream object and passes it to the plug-in in as a parameter to npp_newstream or npn_newstream. ...

CORS - MDN Web Docs Glossary: Definitions of Web-related terms
cors (cross-origin resource sharing) is a system, consisting of transmitting http headers, that determines whether browsers block frontend javascript code from accessing responses for cross-origin requests. the same-origin security policy forbids cross-origin access to resources. but cors gives web servers the ability to say they want to opt into allowing cross-origin access to their resources. learn more general knowledge cross-origin resource sharing (cors) on mdn cross-origin resource sharing on wikipedia cors headers access-control-allow-origin indicates whether the response can be shared. ...
...cess to their resources. learn more general knowledge cross-origin resource sharing (cors) on mdn cross-origin resource sharing on wikipedia cors headers access-control-allow-origin indicates whether the response can be shared. access-control-allow-credentials indicates whether or not the response to the request can be exposed when the credentials flag is true. access-control-allow-headers used in response to a preflight request to indicate which http headers can be used when making the actual request. access-control-allow-methods specifies the method or methods allowed when accessing the resource in response to a preflight request. access-control-expose-headers indicates which headers can be exposed as part of the response by listing their names. access-control-max-age indi...
... making the actual request. access-control-allow-methods specifies the method or methods allowed when accessing the resource in response to a preflight request. access-control-expose-headers indicates which headers can be exposed as part of the response by listing their names. access-control-max-age indicates how long the results of a preflight request can be cached. access-control-request-headers used when issuing a preflight request to let the server know which http headers will be used when the actual request is made. access-control-request-method used when issuing a preflight request to let the server know which http method will be used when the actual request is made. origin indicates where a fetch originates from. technical reference fetch specification ...

Fetch metadata request header - MDN Web Docs Glossary: Definitions of Web-related terms
a fetch metadata request header is a http request header that provides additional information about the context the request originated from. these header names are prefixed with sec- and thus they are forbidden header names so headers can not be modified from javascript. ...
... a fetch metadata request header is a http request header that provides additional information about the context the request originated from. these header names are prefixed with sec- and thus they are forbidden header names so headers can not be modified from javascript. ...
...ation about the context the request originated from. these header names are prefixed with sec- and thus they are forbidden header names so headers can not be modified from javascript. fetch metadata request headers provide the server with additional information about where the request originated from, enabling it to ignore potentially malicious requests. ...

Forbidden header name - MDN Web Docs Glossary: Definitions of Web-related terms
a forbidden header name is the name of any http header that cannot be modified programmatically; specifically, an http request header name (in contrast with a forbidden response header name). modifying such headers is forbidden because the user agent retains full control over them. names starting with `sec-` are reserved for creating new headers safe from apis using fetch that grant developers control over headers, such as xmlhttprequest. ...
...). modifying such headers is forbidden because the user agent retains full control over them. names starting with `sec-` are reserved for creating new headers safe from apis using fetch that grant developers control over headers, such as xmlhttprequest. ...
... however, chrome will silently drop the header from fetch requests (see chromium bug 571722). ...

Eclipse CDT Manual Setup
s.) initial project properties so that the indexer will run faster and give better results, and so that eclipse doesn't give results for irrelevant files, you should add some resource filters to have eclipse ignore certain non-source files and directories. note, you must not make eclipse ignore your (main) object directory. that object directory is needed to resolve include paths to the various headers that the build process generates/copies there. to create resource filters, open the project properties (different to the workspace preferences!) by selecting properties from the context menu for the project (root item) in the project explorer tab on the left, or by selecting project > properties from the menubar. select "resource > resource filters" on the left of the window that opens, then use...
...tree is located somewhere outside your tree's top source directory: if this applies to you, then select the entries tab, select "gnu c++", select "cdt user settings entries", and click "add". change "project path" to "filesystem", then select the 'dist/include' directory that's in your main object directory and click ok. repeat these steps, but this time for "gnu c" instead of "gnu c++". (see the headers are only parsed once section below to understand why this step is important for people who have their object directory outside their source tree.) getting code assistance working you're now ready to get code assistance working. :-) build option discovery this section requires that you have already built your mozilla source tree (so that you have an object directory for it), and it is strongly...
... ...

Creating localizable web applications
in the english strings. write semantic code (e.g. don't use text and <img/> for decorations; instead, use css). document your code so that localizers know what they're translating (e.g. in gettext use comments and contexts). app logic detect the locale correctly be smart about detecting the user's locale correctly. you can use one or more of the following techniques: http accept-language headers, the ua string, ip geolocation. see examples of the addons.mozillaorg code at /addons/trunk/site/app/config/language.php and /addons/trunk/site/app/config/language.inc.php. the language_config class expects arrays of valid languages & supported languages. always give the user a possibility to change the locale (e.g. by adding locale dropdown menu at bottom of page) and remember this choice f...
...tes (this is wrong: http://en-us.example.com/foo/bar). simplify localized versions if necessary oftentimes, it is better to slightly simplify the localized version of your web application than to serve a mix of localized and english content. for example, if not all the pages of your website are going to be localized, you may consider removing links to the english-only pages from the navigation (headers, footers, sidebars) in the localized versions. define the locale and the direction in the html generate the lang attribute dynamically, depending on the current locale. use the dir attribute on the <html/> element and consider using a rtl class on <html/> or <body/> as well, in order to easily change css rules like in the example below. snippet 1. bad: <html lang="en"> snippet 2. good: css...
...essages), or in javascript libraries and scripts. if you are using pure html instead of gettext to localize your webapp, consider using an additional gettext-like format such as .lang to streamline localizers' work with repeating content. this is useful for strings occurring in the webapp multiple times, like "return to top", "comments", "click to see larger image" etc. might be also helpful for headers and footers, if you're not using templates to display them. in most of the cases though, you should use gettext whenever technically possible (i.e. the server's php has been built with gettext support). localize the date format localizing the date format is as easy as localizing any other string. just let the localizers localize the format specification string. snippet 1. bad: $persona['date...

AsyncTestUtils extended framework
ode that creates synthetic message sets returns instances of the syntheticmessageset class. this class not only holds references to the syntheticmessage instances, but it also tracks what folders they were injected into as well as what folders you move them to. this allows you to get at the nsimsgdbhdr instances directly. keep in mind that the class is not magic and will lose track of the message headers if you manipulate them without referencing the message set. accessing synthetic messages and headers synmessages [attribute] the js list of syntheticmessages held in the set. while you should not modify this list, you can get its length and read from it. getmsghdr(aindex) [function] retrieve the nsimsgdbhdr at the given index. getmsguri(aindex) [function] retrieve the uri of the message ...
... list, you can get its length and read from it. getmsghdr(aindex) [function] retrieve the nsimsgdbhdr at the given index. getmsguri(aindex) [function] retrieve the uri of the message header at the given index. msghdrlist [getter] return a js list with all the nsimsgdbhdrs for the messages that have been injected into folders. xpcomhdrarray [getter] return an nsimutablearray of the message headers that have been injected into folders. folderswithmsghdrs [getter] return a list where each element is a list with two sub-elements. the first is an nsimsgfolder and the second is a js list of all the nsimsgdbhdrs for the messages that were inserted into the folder. this is used by routines that need to process the messages grouped by the folder they belong to, such as initiating message moves. ...
...he union of this set and the provided other set and return the (new, not modified) result. you should stop using both the message set that you called this on and the other set that you passed in unless you are very careful. namely, if you use async_move_messages / async_trash_messages on the resulting set, the original sets won't know the messages moved and will get confused if you try and access headers via them again. slice(...) uses the js array.slice semantics to slice the set. same warnings as union apply. configuring message injection local injection let inboxfolder = configure_message_injection({mode: "local"}); set up message injection to happen locally. this is different from using a pop fake-server. we just cram them using addmessage, although we try and approximate what would ...

PR_TransmitFile
sends a complete file across a connected socket. syntax #include <prio.h> print32 pr_transmitfile( prfiledesc *networksocket, prfiledesc *sourcefile, const void *headers, print32 hlen, prtransmitfileflags flags, printervaltime timeout); parameters the function has the following parameters: networksocket a pointer to a prfiledesc object representing the connected socket to send data over. sourcefile a pointer to a prfiledesc object representing the file to send. headers a pointer to the buffer holding the headers to be sent before sending data. hlen length of the headers buffer in bytes. flags one of the following flags: pr_transmitfile_keep_open indicates that the socket will be kept open after the data is sent. pr_transmitfile_close_socket indicates that the c...
...lags: pr_transmitfile_keep_open indicates that the socket will be kept open after the data is sent. pr_transmitfile_close_socket indicates that the connection should be closed immediately after successful transfer of the file. timeout time limit for completion of the transmit operation. ...
... number of bytes successfully written, including both the headers and the file. the value -1 indicates a failure. if an error occurs while sending the file, the pr_transmitfile_close_socket flag is ignored. the reason for the failure can be obtained by calling pr_geterror. description the pr_transmitfile function sends a complete file (sourcefile) across a connected socket (networksocket). if headers is non-null, pr_transmitfile sends the headers across the socket before sending the file. the enumeration prtransmitfileflags, used in the flags parameter, is defined as follows: typedef enum prtransmitfileflags { pr_transmitfile_keep_open = 0, pr_transmitfile_close_socket = 1 } prtransmitfileflags; ...

Encrypt Decrypt MAC Keys As Session Objects
nss sample code 4: encryption/decryption and mac keys using session. generates encryption/mac keys and uses session objects. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...yption/decryption and mac keys using session. generates encryption/mac keys and uses session objects. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... strcpy(trailer, mac_trailer); break; case pad: strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; ...

Encrypt and decrypt MAC using token
nss sample code 3: encryption/decryption and mac using token object. generates encryption/mac keys and uses token for storing. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...tion/decryption and mac using token object. generates encryption/mac keys and uses token for storing. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... strcpy(trailer, mac_trailer); break; case pad: strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; ...

Index
no summary! 185 nss sample code sample6 no summary! 186 utilities for nss samples these utility functions are adapted from those found in the sectool library used by the nss security tools and other nss test applications. 187 sample1 example, nss 1. a program to compute the hash of a file and save it to another file. ...
... these utility functions are adapted from those found in the sectool library used by the nss security tools and other nss test applications. 187 sample1 example, nss 1. a program to compute the hash of a file and save it to another file. ...
...d message for a set of recipients to which you would like to send an encrypted message. if this is the first encrypted message for that set of recipients, a new enveloped message will be created that you can then use for future messages (encrypt only). -g include a signing time attribute (sign only). -h num generate email headers with info about cms message (decode only). -i infile use infile as a source of data (default is stdin). -n nickname specify nickname of certificate to sign with (sign only). -n suppress output of contents (decode only). -o outfile use outfile as a destination of data (default is stdout). -p include an s/mime capabilit...

Encrypt Decrypt_MAC_Using Token
nss sample code 3: encryption/decryption and mac using token object. generates encryption/mac keys and uses token for storing. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...tion/decryption and mac using token object. generates encryption/mac keys and uses token for storing. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...*/ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file. */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; ...

EncDecMAC using token object - sample 3
nc/dec/mac using token object id.</h2> <p class="summary">computes the hash of a file and saves it to another file, illustrates the use of nss message apis.</p> <pre class="brush: cpp"> /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
... file and saves it to another file, illustrates the use of nss message apis.</p> <pre class="brush: cpp"> /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...eader, iv_header); strcpy(trailer, iv_trailer); break; case mac: strcpy(header, mac_header); strcpy(trailer, mac_trailer); break; case pad: strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } rv = filetoitem(&filedata, file); nonbody = (char *)filedata.data; if (!nonbody) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(nonbody, header)) != null) { char *trail = null; nonbody = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(nonbody, '\r'); /* maybe this is a mac file */ if (body) trail = strstr(++body, trailer); if (trail != null) { *trail = '\0'; } else { pr_fprintf(pr_stderr, "input has header but no trailer\n"); port_free(filedata.data); ...

SpiderMonkey Build Documentation
try configuring like so: cc=clang cxx=clang++ ../configure it is also possible that baldrdash may fail to compile with /usr/local/cellar/llvm/7.0.1/lib/clang/7.0.1/include/inttypes.h:30:15: fatal error: 'inttypes.h' file not found /usr/local/cellar/llvm/7.0.1/lib/clang/7.0.1/include/inttypes.h:30:15: fatal error: 'inttypes.h' file not found, err: true this is because, starting from mohave, headers are no longer installed in /usr/include. refer the release notes under command line tools -> new features the release notes also states that this compatibility package will no longer be provided in the near future, so the build system on macos will have to be adapted to look for headers in the sdk until then, the following should help, open /library/developer/commandlinetools/packages/macos...
...no longer installed in /usr/include. refer the release notes under command line tools -> new features the release notes also states that this compatibility package will no longer be provided in the near future, so the build system on macos will have to be adapted to look for headers in the sdk until then, the following should help, open /library/developer/commandlinetools/packages/macos_sdk_headers_for_macos_10.14.pk this builds an executable named js in the directory build-release/dist/bin. you can test it with dist/bin/js --help, which displays a help page. at this point, you're ready to run and try out the shell. on mac, linux, or unix, you can install spidermonkey on your system with the additional command make install. this installs the shared library to /usr/local/lib, the c heade...
... you pass to configure are recorded in the generated makefile, so you don't need to specify them again until you re-run configure. building your application while "how to build your complete application" is clearly out of scope for this document, here are some tips that will help get you on your way: the spidermonkey developers frequently and deliberately change the jsapi abi. you cannot use headers built for one version/configuration of jsapi to create object files which will be linked against another. support for js_threadsafe was recently removed, and threadsafe builds are now enabled by default. the js-config script, described below, is the recommended way to determine correct include paths, required libraries, etc. for your embedding to use during compilation. we highly recommend call...

XPCOM glue
extension or xulrunner application components, should use the dependent glue. ...
...extension or xulrunner application components, should use the dependent glue. ...
...com other than the one it was compiled against. internal linkage will be unavailable to extension authors in xulrunner 1.9 (firefox 3) because the nonfrozen symbols will not be exported from libxul. extension and application authors currently using internal linkage should read the guide on migrating from internal linkage to frozen linkage. sample compiler/linker flags code compiled using xpcom headers should always #include "xpcom-config.h" from the sdk, to ensure that xpcom #defines are correct. linking strategy: dependent glue standalone glue compiler flags: cross-platform #include "xpcom-config.h" #include "xpcom-config.h" #define xpcom_glue windows /fi "xpcom-config.h" linux -include "xpcom-config.h" linker flags:...

Setting up the Gecko SDK
viousnext » this chapter provides basic setup information for the gecko software development kit (sdk) used to build the weblock component in this tutorial. the following four sections tell the developer how to download and organize the gecko sdk and create a new project in which components like weblock can be created. downloading and setting the sdk the gecko sdk provides all of the tools, headers, and libraries that you need to build xpcom components. the sdk is available for windows, linux, and mac operating systems, and versions for other operating systems are being developed, and can be retrieved from as a single archive from the following platform-specific locations (need correction for last version (now 1.9.2.8). there is now separate archive with gecko-sdk, just xul-runner-sdk.): ...
... set up the windows gecko sdk in c:\gecko-sdk\. if you choose some other location, remember to adjust the settings described here (e.g., in the building a microsoft visual cpp project section below) to point to this new location. when you extract the sdk, it should have the layout seen below: layout of the extracted sdk the directories represent different modules in the sdk. for example, the headers for networking are all located in the necko directory, and the headers that xpcom requires are in the xpcom directory. this directory structure makes build scripts slightly more complicated (since there will be many different include paths), but it helps to organize the parts of the sdk meaningfully. the two top level header files are special. the file mozilla-config.h lists all of the defines u...
.... the includes directory contains c++ header files used by your component. xpcom exports a number of binaries that should be mentioned at this point. the table below refers to the windows file names for the executables. application name description of functionality regxpcom.exe registers or unregisters components with xpcom xpidl.exe generates typelib and c++ headers from xpidl xpt_dump.exe prints out information about a given typelib xpt_link.exe combines multiple typelibs into a single typelib library name description of functionality xpcomglue.lib xpcom glue library to be used by xpcom components. building a microsoft visual cpp project once you set up the gecko sdk, you can create a microsoft ...

Observer Notifications
s taken offline. network:offline-status-changed called when the offline state has changed. note: the data value for this notification 'offline' or 'online' to indicate the new state. network:link-status-changed called when the network link status changes. http requests these are the topics that you can observe during a http request (see setting http request headers and creating sandboxed http connections). both are passed an nsihttpchannel as the subject parameter. topic description http-on-modify-request called as a http request is made. the channel is available to allow you to modify headers and such. see this code snippet to learn how to get the tab that issued the request. http-on-opening-request similar to http-on-...
...e tab that issued the request. http-on-opening-request similar to http-on-modify-request, but called earlier (synchronously during the channel's asyncopen() call), and some channel attributes (proxyinfo) may be missing. use only if your observer must be called before asyncopen returns. http-on-examine-response called after a response has been received from the web server. headers are available on the channel. the response can be accessed and modified via nsitraceablechannel. http-on-examine-cached-response called instead of http-on-examine-response when a response will be read completely from the cache. headers are available on the channel. http-on-examine-merged-response called instead of http-on-examine-response when a response will be read parti...
... cookies these topics indicate whenever a cookie has been changed (added, changed, cleared, or deleted) or its setting rejected by the browser. see nsicookieservice for details. ...

nsIDocShell
boolean isbeingdestroyed(); void loadstream(in nsiinputstream astream, in nsiuri auri, in acstring acontenttype, in acstring acontentcharset, in nsidocshellloadinfo aloadinfo); native code only! void loaduri(in nsiuri ...
...internalload loads the given uri. this method is identical to loaduri() except that its parameter list is broken out instead of being packaged inside of an nsidocshellloadinfo object. void internalload( in nsiuri auri, in nsiuri areferrer, in nsisupports aowner, in pruint32 aflags, in wstring awindowtarget, in string atypehint, in nsiinputstream apostdatastream, in nsiinputstream aheadersstream, in unsigned long aloadflags, in nsishentry ashentry, in boolean firstparty, out nsidocshell adocshell, out nsirequest arequest ); parameters auri the uri to load. areferrer referring uri. aowner owner (security principal) aflags a combination of the internal load flags as detailed in the constants secion. awindowtarget window target for t...
... the uri to load. areferrer referring uri. aowner owner (security principal) aflags a combination of the internal load flags as detailed in the constants secion. awindowtarget window target for the load. atypehint a hint as to the content-type of the resulting data. may be null or empty if no hint. apostdatastream post data stream (if posting) aheadersstream stream containing "extra" request headers. aloadflags flags to modify load behaviour. flags are defined in nsiwebnavigation. ashentry active session history entry (if loading from sh) firstparty true if this is the master top-level document. adocshell if the load was succesfully initiated, this receives the nsidocshell that actually performed the load. ...

nsIHttpHeaderVisitor
netwerk/protocol/http/nsihttpheadervisitor.idlscriptable this interface is used to view http request and response headers. inherits from: nsisupports last changed in gecko 1.7 method overview void visitheader(in acstring aheader, in acstring avalue); methods visitheader() called by the nsihttpchannel implementation when visiting request and response headers. this method can throw an exception to terminate enumeration of the channel's headers. void visitheader( in acstring aheader, in acstring avalue ); parameters aheader a string containing the key for a header such as "content-type" avalue the header's value field such as "text/html". multiple values are separated by a comma. example this example shows how to detect flash content. it implements...
...es are separated by a comma. example this example shows how to detect flash content. it implements the nsihttpheadervisitor interface in javascript and uses it to evaluate the mime type of a http response. this is done by subscribing to the http-on-examine-response and http-on-examine-cached-response observers. when the observer fires, the visitor interface is used to walk through the response headers and evaluate the mime type. mynsihttpheadervisitor = function ( ) { this._isflash = false; }; mynsihttpheadervisitor.prototype.visitheader = function ( aheader, avalue ) { if ( aheader.indexof( "content-type" ) !== -1 ) { if ( avalue.indexof( "application/x-shockwave-flash" ) !== -1 ) { this._isflash = true; } } }; mynsihttpheadervi...
...nterfaces.nsihttpchannel; this.nsichannel = components.interfaces.nsichannel; this.nsirequest = components.interfaces.nsirequest; }; myhttprequestobserver.prototype.observe = function ( subject, topic, data ) { var uri, avisitor; if ( subject instanceof this.nsihttpchannel ) { avisitor = new mynsihttpheadervisitor( ); subject.visitresponseheaders( avisitor ); if ( avisitor.isflash( ) ) { uri = subject.uri; subject.cancel( this.aborted ); alert( "found flash!" ); //handle flash file here } } }; myhttprequestobserver.prototype.register = function ( ) { var observerservice = components.classes[ "@mozilla.org/observer-service;1" ].getservice( components...

nsIMsgDBView
f" (virtual folders), "search", "group", and "threaded" each with their own implementation of nsimsgdbview that provides a different sorting/view of the data. ...
...sed for the folder. defined in the interface: nsmsgviewsortorder. viewflags other flags to be used. defined in the interface: nsmsgviewflagstype. return values count upon return, the count variable may contain the number of messages in the folder. note: this return value does not appear to be implemented in the base implementation. openwithhdrs() opens the view with a set of specified headers. ...
...n the interface: nsmsgviewflagstype. return values count upon return, the count variable may contain the number of messages in the folder. note: this return value does not appear to be implemented in the base implementation. openwithhdrs() opens the view with a set of specified headers. note: this is not implemented in the base implementation. void openwithhdrs(in nsisimpleenumerator aheaders, in nsmsgviewsorttypevalue asorttype, in nsmsgviewsortordervalue asortorder, in nsmsgviewflagstypevalue aviewflags, out long acount); parameters aheaders a list of headers to open, arranged in an nsisimpleenumerator. asorttype a nsmsgviewsorttypevalue designating the sort type used for the folder. defined in the i...

nsIMsgSearchSession
p, in nsimsgsearchvalue value); long countsearchscopes(); void getnthsearchscope(in long which,out nsmsgsearchscopevalue scopeid, out nsimsgfolder folder); void addscopeterm(in nsmsgsearchscopevalue scope, in nsimsgfolder folder); void adddirectoryscopeterm(in nsmsgsearchscopevalue scope); void clearscopes(); [noscript] boolean scopeusescustomheaders(in nsmsgsearchscopevalue scope, in voidptr selection, in boolean forfilters); boolean isstringattribute(in nsmsgsearchattribvalue attrib); void addallscopes(in nsmsgsearchscopevalue attrib); void search(in nsimsgwindow awindow); void interruptsearch(); void pausesearch(); void resumesearch(); [noscript] nsmsgsearchtype setsearchparam(...
...n values scopeid folder addscopeterm() add a scope (e.g. a mail folder) to the search. ...
...der folder); parameters scope folder adddirectoryscopeterm() void adddirectoryscopeterm(in nsmsgsearchscopevalue scope); parameters scope clearscopes() void clearscopes(); scopeusescustomheaders() call this function everytime the scope changes! it informs the fe if the current scope support custom header use. fes should not display the custom header dialog if custom headers are not supported. [noscript] boolean scopeusescustomheaders(in nsmsgsearchscopevalue scope, in voidptr selection, in boolean forfilters); parameters scope selection could be a folder or server based on scope forfilters isstringattribute() use this to determine if your attribute is a string attribute. boolean isstringattribute(in ns...

nsIUploadChannel2
ic/nsiuploadchannel2.idlscriptable please add a summary to this article. 1.0 66 introduced gecko 1.9.2 inherits from: nsisupports last changed in gecko 1.9.2 (firefox 3.6 / thunderbird 3.1 / fennec 1.0) method overview void explicitsetuploadstream(in nsiinputstream astream, in acstring acontenttype, in long long acontentlength, in acstring amethod, in boolean astreamhasheaders); methods explicitsetuploadstream() sets a stream to be uploaded by this channel with the specified content-type and content-length header values. most implementations of this interface require that the stream: implement threadsafe addref and release implement nsiinputstream.readsegments() implement nsiseekablestream.seek(). void explicitsetuploadstream( in nsiinputstream astream, in acs...
...cified content-type and content-length header values. most implementations of this interface require that the stream: implement threadsafe addref and release implement nsiinputstream.readsegments() implement nsiseekablestream.seek(). void explicitsetuploadstream( in nsiinputstream astream, in acstring acontenttype, in long long acontentlength, in acstring amethod, in boolean astreamhasheaders ); parameters astream the stream to be uploaded by this channel. acontenttype this value will replace any existing content-type header on the http request, regardless of whether or not its empty. acontentlength a value of -1 indicates that the length of the stream should be determined by calling the stream's available method. amethod the http request method to set on the stream. astreamhasheade...
...be uploaded by this channel. acontenttype this value will replace any existing content-type header on the http request, regardless of whether or not its empty. acontentlength a value of -1 indicates that the length of the stream should be determined by calling the stream's available method. amethod the http request method to set on the stream. astreamhasheaders true if the stream already contains headers for the http request. ...

nsIWebBrowserPersist
n nsichannel achannel, in nsisupports afile); void savedocument(in nsidomdocument adocument, in nsisupports afile, in nsisupports adatapath, in string aoutputcontenttype, in unsigned long aencodingflags, in unsigned long awrapcolumn); void saveuri(in nsiuri auri, in nsisupports acachekey, in nsiuri areferrer, in long areferrerpolicy, in nsiinputstream apostdata, in string aextraheaders, in nsisupports afile, in nsiloadcontext aprivacycontext); void saveprivacyawareuri(in nsiuri auri, in nsisupports acachekey, in nsiuri areferrer, in long areferrerpolicy, in nsiinputstream apostdata, in string aextraheaders, in nsisupports afile, in boolean aisprivate); attributes attribute type description currentstate unsigned long current state o...
... as of firefox 36, a new parameter areferrerpolicy was added as the fourth argument, changing the number of parameters from 7 to 8 and shifting the order of the parameters in a backwards incompatible way. save the specified uri to file. void saveuri( in nsiuri auri, in nsisupports acachekey, in nsiuri areferrer, in long areferrerpolicy, in nsiinputstream apostdata, in string aextraheaders, in nsisupports afile, in nsiloadcontext aprivacycontext ); parameters auri uri to save to file. some implementations of this interface may also support nsnull to imply the currently loaded uri. acachekey an object representing the uri in the cache or nsnull. this can be a necko cache key, an nsiwebpagedescriptor, or the currentdescriptor of an nsiwebpagedescriptor. areferrer the re...
...chekey an object representing the uri in the cache or nsnull. this can be a necko cache key, an nsiwebpagedescriptor, or the currentdescriptor of an nsiwebpagedescriptor. areferrer the referrer uri to pass with an http request or nsnull. areferrerpolicy the referrer policy to use for the request, taken from nsihttpchannel. apostdata post data to pass with an http request or nsnull. aextraheaders additional headers to supply with an http request or nsnull. afile target file. this may be a nsilocalfile object or an nsiuri object with a file scheme or a scheme that supports uploading (for example ftp). aprivacycontext a context derived from a relevant window or document (eg. the window containing a link being saved) via a docshell that qis to nsiloadcontext. used to ensure that privacy...

nsIWebNavigation
gecko 1.9.2 note in gecko 1.9.2 (firefox 3.6), the @mozilla.org/webshell;1 component no longer exists; you need to use @mozilla.org/docshell;1 instead. method overview void goback void goforward void gotoindex( in long index ) void loaduri(in wstring uri , in unsigned long loadflags , in nsiuri referrer , in nsiinputstream postdata, in nsiinputstream headers) void reload(in unsigned long reloadflags) void stop(in unsigned long stopflags) constants load flags constant value description load_flags_mask 65535 this flag defines the range of bits that may be specified. load_flags_none 0 this is the default value for the load flags parameter. load_flags_is_refresh 16 th...
...dex of the session history item to go to. loaduri() loads a given uri. this will give priority to loading the requested uri in the object implementing this interface. if it can't be loaded here however, the uri dispatcher will go through its normal process of content loading. void loaduri( wstring uri, unsigned long loadflags, nsiuri referrer, nsiinputstream postdata, nsiinputstream headers ); parameters uri the uri string to load. for http and ftp urls and possibly others, characters above u+007f will be converted to utf-8 and then url- escaped per the rules of rfc 2396. loadflags flags modifying load behaviour. this parameter is a bitwise combination of the load flags defined above. (undefined bits are reserved for future use.) generally you will pass load_flags_none for t...
.... this parameter is a bitwise combination of the load flags defined above. (undefined bits are reserved for future use.) generally you will pass load_flags_none for this parameter. referrer the referring uri. if this argument is null, then the referring uri will be inferred internally. postdata if the uri corresponds to a http request, then this stream is appended directly to the http request headers. it may be prefixed with additional http headers. this stream must contain a \r\n sequence separating any http headers from the http request body. this parameter may be null. headers if the uri corresponds to a http request, then any http headers contained in this stream are set on the http request. the http header stream is formatted as: ( header \r\n )* this parameter may be null. reload() ...

Main Windows
, keysets, and context menus of thunderbird, along with a whole lot of javascript. mailoverlay.xul a really small overlay that only adds a few “new message” and “new card” commands to the menus, along with their associated javascript. msghdrviewoverlay.xul shown in blue above (where?), this overlay consists of three boxes. two are stacked showing either a brief or expanded view of the headers. the third is the attachment box which can be toggled into a slim or an expanded view basemenuoverlay.xul contains the contents of most of the menus (i.e. file, edit, view, etc). osx only: macmenuoverlay.xul a special overlay for osx that adds a few items to the window menu. messagewindow.xul messagewindow.xul is shown when a message is opened. its almost exactly the same as messenger.xul ...
... contains the contents of most of the menus (i.e. file, edit, view, etc). osx only: macmenuoverlay.xul a special overlay for osx that adds a few items to the window menu. messagewindow.xul messagewindow.xul is shown when a message is opened. its almost exactly the same as messenger.xul in terms of overlays, but just lacks the folder and threadpanes normally shown. menus, toolbar buttons, and headers are all taken from exactly the same overlays listed above though. mailwindowoverlay.xul this is the red sections shown in the interface above, including the toolbars, notification bars and the status bar.it also includes most of the commands, keysets, and context menus of thunderbird, along with a whole lot of javascript. msghdrviewoverlay.xul shown in blue above, this overlay consists of ...
...indowoverlay.xul this is the red sections shown in the interface above, including the toolbars, notification bars and the status bar.it also includes most of the commands, keysets, and context menus of thunderbird, along with a whole lot of javascript. msghdrviewoverlay.xul shown in blue above, this overlay consists of three boxes. two are stacked showing either a brief or expanded view of the headers. the third is the attachment box which can be toggled into a slim or an expanded view basemenuoverlay.xul contains the contents of most of the menus (i.e. file, edit, view, etc). osx only: macmenuoverlay.xul a special overlay for osx that adds a few items to the window menu. customizetoolbar.xul and customizetoolbarsheet.xul these are two old files from when the original customizable toolb...

WebIDL bindings
can be very simple. all the generated code is placed in the mozilla::dom namespace. for each interface, a namespace whose name is the name of the interface with binding appended is created, and all the things pertaining to that interface's binding go in that namespace. there are various helper objects and utility methods in dom/bindings that are also all in the mozilla::dom namespace and whose headers are all exported into mozilla/dom (placed in $objdir/dist/include by the build process). adding webidl bindings to a class to add a webidl binding for interface myinterface to a class mozilla::dom::myinterface that's supposed to implement that interface, you need to do the following: if your interface doesn't inherit from any other interfaces, inherit from nswrappercache and hook up the c...
...ng '.h', then add a corresponding 'headerfile' annotation (or headerfile annotation to the .webidl file). if you don't have to set any annotations, then you don't need to add an entry either and the code generator will simply assume the defaults here. note that using a 'headerfile' annotation is generally not recommended. if you do use it, you will need to make sure your header includes all the headers needed for your func annotations. add external interface entries to bindings.conf for whatever non-webidl interfaces your new interface has as arguments or return values. implement a wrapobject override on mozilla::dom::myinterface that just calls through to mozilla::dom::myinterface_binding::wrap. note that if your c++ type is implementing multiple distinct web idl interfaces, you need to choo...
...actual object the property would be defined on. in the xray case that means obj is in the target compartment (typically content) and cx is typically chrome. this extended attibute can be specified together with [chromeonly], and [pref]. if more than one of these is specified, all conditions will need to test true for the interface or interface member to be exposed. binding code will include the headers necessary for a [func], unless the interface is using a non-deafault heder file. if a non-default header file is used, that header file needs to do any header inclusions necessary for [func] annotations. [throws], [getterthrows], [setterthrows] used to flag methods or attributes as allowing the c++ callee to throw. this causes the binding generator, and in many cases the jit, to generate extra...

URLs - Plugins
eaks ('\n' separators only). npn_posturl works identically with buffers and files. to post data from a memory buffer, set the flag file to false, the buffer buf to the data to post, and len to the length of the buffer. possible url types include http (similar to an html form submission), mailto (sending mail), news (posting a news article), and ftp (uploading a file). for protocols in which the headers must be distinguished from the body, such as http, the buffer or file should contain the headers, followed by a blank line, then the body. if no custom headers are required, simply add a blank line ('\n') to the beginning of the file or buffer. note: you cannot use npn_posturl to specify headers (even a blank line) in a memory buffer. to do this, use npn_posturlnotify for this purpose. § the np...
...npn_posturlnotify is typically asynchronous: it returns immediately and only later handles the request and calls npp_urlnotify. ...
...e response in a frame named response: char* mydata = "file:///c\/mydirectory/myfilename"; uint32 mylength = strlen(mydata) + 1; err = npn_posturl(instance, "ftp://fred@ftp.example.com/pub/", "response", mylength, mydata, true); sending mail a plug-in can send an email message using npn_posturl or npn_posturlnotify. the following code sends a mail message with the default headers from the client machine. char* mydata = "\nhi fred, this is a message from my plug-in!"; uint32 mylength = strlen(mydata) + 1; err = npn_posturlnotify(instance, "mailto:fred@example.com", null, mylength, mydata, false); the example starts by defining the mail message, mydata, and its length, mylength. it sends mydata and mylength to the mailto url mailto:fred@example.com. the target window...

Network request list - Firefox Developer Tools
ie-value:true regexp shows the resources having a url that matches the given regular expression. regexp:\d{5} regexp:mdn|mozilla for example, to find all 404, not found, errors, you can type "404" into the search and auto-complete suggests "status-code:404" so you'll end up with something like this: search in requests use the search panel to run a full-text search on headers and content. click the search icon in the toolbar. this opens the search sidebar. enter a string in the search field of the sidebar, and press enter or return. the search results area below the search field displays the requests that contain that string in the request or response headers or in the content of the response. you can expand each item to show the specific item that matches the ...
... menuitem description copy > copy url copies the url. copy > copy as curl copies the network request to the clipboard as a curl command, so you can execute it from a command line. see copy as curl, below. copy > copy as fetch copies the request as a call to the fetch() method, including the url and any settings object. copy > copy request headers copies the request's header to the clipboard. copy > copy response headers copies the headers of the response for this request, to the clipboard. copy > copy response copies the entire response that was sent for this request. copy > copy all as har creates an http archive (har) for all requests listed, and copies it to the clipboard. save all as har...
...ive (har) for all requests listed, and copies it to the clipboard. save all as har creates an http archive (har) for all requests listed, and opens a file dialog, so you can save it to a file. resend resends the request as it was originally sent with no changes made. edit and resend opens an editor enabling you to edit the request's method, url, parameters, and headers, and resend the request. block url blocks the selected url for future requests. see blocking a specific url from the request list. open in new tab resends the request in a new tab — very useful for debugging asynchronous requests. open in style editor for a css resource, opens it in the style editor. start performance analysis use as fet...

HTMLTableCellElement - Web APIs
ddle">htmltablecellelement</text></a></svg></div> a:hover text { fill: #0095dd; pointer-events: all;} properties inherits properties from its parent, htmlelement. htmltablecellelement.abbr a domstring which can be used on <th> elements (not on <td>), specifying an alternative label for the header cell.. this alternate label can be used in other contexts, such as when describing the headers that apply to a data cell. this is used to offer a shorter term for use by screen readers in particular, and is a valuable accessibility tool. usually the value of abbr is an abbreviation or acronym, but can be any text that's appropriate contextually. htmltablecellelement.cellindex read only a long integer representing the cell's position in the cells collection of the <tr> the cell is contai...
...ng integer representing the cell's position in the cells collection of the <tr> the cell is contained within. if the cell doesn't belong to a <tr>, it returns -1. htmltablecellelement.colspan an unsigned long integer indicating the number of columns this cell must span; this lets the cell occupy space across multiple columns of the table. it reflects the colspan attribute. htmltablecellelement.headers read only is a domsettabletokenlist describing a list of id of <th> elements that represents headers associated with the cell. it reflects the headers attribute. htmltablecellelement.rowspan an unsigned long integer indicating the number of rows this cell must span; this lets a cell occupy space across multiple rows of the table. it reflects the rowspan attribute. htmltablecellelement.scope ...
... specification status comment html living standardthe definition of 'htmltablecellelement' in that specification. living standard no change from html5. html5the definition of 'htmltablecellelement' in that specification. recommendation the following properties have been obsoleted: align, axis, bgcolor, height, width, ch, choff, nowrap, and valign. the headers property is now read-only and contains a domsettabletokenlist rather than a mere domstring. the colspan and rowspan properties are now unsigned long. document object model (dom) level 2 html specificationthe definition of 'htmltablecellelement' in that specification. obsolete the cellindex property is now read-only. document object model (dom) level 1 specificationthe d...

XMLHttpRequest.getResponseHeader() - Web APIs
the xmlhttprequest method getresponseheader() returns the string containing the text of a particular header's value. if there are multiple response headers with the same name, then their values are returned as a single concatenated string, where each value is separated from the previous one by a pair of comma and space. the getresponseheader() method returns the value as a utf byte sequence. note: the search for the header name is case-insensitive. if you need to get the raw string of all of the headers, use the getallresponseheaders() method, which returns the entire raw header string. syntax var myheader = xmlhttprequest.getresponseheader(headername); parameters headername a bytestring indicating the name of the header you want to return the text value of. return value a bytestri...
...string indicating the name of the header you want to return the text value of. return value a bytestring representing the header's text value, or null if either the response has not yet been received or the header doesn't exist in the response. ...
...te to indicate that the headers have been received; when that is the case, the value of the content-type header is fetched. if the content-type isn't the desired value, the xmlhttprequest is canceled by calling abort(). var client = new xmlhttprequest(); client.open("get", "unicorns-are-teh-awesome.txt", true); client.send(); client.onreadystatechange = function() { if(this.readystate == this.headers_received) { var contenttype = client.getresponseheader("content-type"); if (contenttype != my_expected_type) { client.abort(); } } } specifications specification status comment xmlhttprequestthe definition of 'getresponseheader()' in that specification. living standard whatwg living standard ...

<tr>: The Table Row element - HTML: Hypertext Markup Language
<td>37.00</td> </tr> <tr> <th>hoshi nakamura</td> <td>601942</td> <td><time datetime="2012-07-23">july 23, 2012</time></td> <td>n/a</td> <td>15.00</td> </tr> </table> the differences that matter here—for the purposes of discussing row and column spans—are in the first few lines of the code above. note the use of rowspan on to make the "name", "id", and "balance" headers occupy two rows instead of just one, and the use of colspan to make the "membership dates" header cell span across two columns. the css is unchanged from before. table { border: 1px solid black; } th, td { border: 1px solid black; } explicitly specifying table content groups before really getting into styling this table, let's take a moment to add row and column groups to help make our...
... <th scope="row">hoshi nakamura</td> <td>601942</td> <td><time datetime="2012-07-23">july 23, 2012</time></td> <td>n/a</td> <td>15.00</td> </tr> </tbody> </table> the differences that matter here—for the purposes of discussing row and column spans—are in the first few lines of the code above. note the use of rowspan on to make the "name", "id", and "balance" headers occupy two rows instead of just one, and the use of colspan to make the "membership dates" header cell span across two columns. once again, we haven't touched the css. table { border: 1px solid black; } th, td { border: 1px solid black; } result the output is entirely unchanged, despite the addition of useful contextual information under the hood: basic styling as is the case with ...
...r of the top header to be a two-pixel wide line. notice, however, that we're using the :nth-of-type selector to apply border-bottom to the second row in the heading. why? because the heading is made of two rows that are spanned by some of the cells. that means there are actually two rows there; applying the style to the first row would not give us the expected result. the "joined" and "canceled" headers let's style these two header cells with green and red hues to represent the "good" of a new member and the "bummer" of a canceled membership. thead > tr:last-of-type > th:nth-of-type(1) { background-color: rgb(225, 255, 225); } thead > tr:last-of-type > th:nth-of-type(2) { background-color: rgb(255, 225, 225); } here we dig into the last row of the table's header block and give the first ...

Using HTTP cookies - HTTP
ally for mobile data connections). modern apis for client storage are the web storage api (localstorage and sessionstorage) and indexeddb. to see stored cookies (and other storage that a web page can use), you can enable the storage inspector in developer tools and select cookies from the storage tree. creating cookies after receiving an http request, a server can send one or more set-cookie headers with the response. the cookie is usually stored by the browser, and then the cookie is sent with requests made to the same server inside a cookie http header. an expiration date or duration can be specified, after which the cookie is no longer sent. additional restrictions to a specific domain and path can be set, limiting where the cookie is sent. for details about the header attributes mentione...
...ookie is sent with requests made to the same server inside a cookie http header. an expiration date or duration can be specified, after which the cookie is no longer sent. additional restrictions to a specific domain and path can be set, limiting where the cookie is sent. for details about the header attributes mentioned below, refer to the set-cookie reference article. ...
...specific domain and path can be set, limiting where the cookie is sent. for details about the header attributes mentioned below, refer to the set-cookie reference article. the set-cookie and cookie headers the set-cookie http response header sends cookies from the server to the user agent. a simple cookie is set like this: set-cookie: <cookie-name>=<cookie-value> this shows the server sending headers to tell the client to store a pair of cookies: http/2.0 200 ok content-type: text/html set-cookie: yummy_cookie=choco set-cookie: tasty_cookie=strawberry [page content] then, with every subsequent request to the server, the browser sends back all previously stored cookies to the server using the cookie header. get /sample_page.html http/2.0 host: www.example.org cookie: yummy_cookie=choco; ta...

A typical HTTP session - HTTP
ed by its parameters: the path of the document, i.e. an absolute url without the protocol or domain name the http protocol version subsequent lines represent an http header, giving the server information about what type of data is appropriate (e.g., what language, what mime types), or other data altering its behavior (e.g., not sending an answer if it is already cached). these http headers form a block which ends with an empty line. the final block is an optional data block, which may contain further data mainly used by the post method. example requests fetching the root page of developer.mozilla.org, i.e. http://developer.mozilla.org/, and telling the server that the user-agent would prefer the page in french, if possible: get / http/1.1 host: developer.mozilla.org accept-lan...
...la.org, i.e. http://developer.mozilla.org/, and telling the server that the user-agent would prefer the page in french, if possible: get / http/1.1 host: developer.mozilla.org accept-language: fr observe that final empty line, this separates the data block from the header block. as there is no content-length provided in an http header, this data block is presented empty, marking the end of the headers, allowing the server to process the request the moment it receives this empty line. for example, sending the result of a form: post /contact_form.php http/1.1 host: developer.mozilla.org content-length: 64 content-type: application/x-www-form-urlencoded name=joe%20user&request=send%20me%20one%20of%20your%20catalogue request methods http defines a set of request methods indicating the desire...
...eb server processes it, and ultimately returns a response. similar to a client request, a server response is formed of text directives, separated by crlf, though divided into three blocks: the first line, the status line, consists of an acknowledgment of the http version used, followed by a status request (and its brief meaning in human-readable text). subsequent lines represent specific http headers, giving the client information about the data sent (e.g. type, data size, compression algorithm used, hints about caching). similarly to the block of http headers for a client request, these http headers form a block ending with an empty line. the final block is a data block, which contains the optional data. example responses successful web page response: http/1.1 200 ok content-type: text/...

HTTP
sages silently like udp does. rudp — the reliable update of udp — is a suitable alternative. tutorials learn how to use http with guides and tutorials. overview of http the basic features of the client-server protocol: what it can do and its intended uses. http cache caching is very important for fast web sites. this article describes different methods of caching and how to use http headers to control them. http cookies how cookies work is defined by rfc 6265. when serving an http request, a server can send a set-cookie http header with the response. the client then returns the cookie's value with every request to the same server in the form of a cookie request header. the cookie can also be set to expire on a certain date, or restricted to a specific domain and path. cross-origi...
...sages describes the type and structure of the different kind of messages of http/1.x and http/2. a typical http session shows and explains the flow of a usual http session. connection management in http/1.x describes the three connection management models available in http/1.x, their strengths, and their weaknesses. reference browse through detailed http reference documentation. http headers http message headers are used to describe a resource, or the behavior of the server or the client. custom proprietary headers can be added using the x- prefix; others in an iana registry, whose original content was defined in rfc 4229. iana also maintains a registry of proposed new http message headers. http request methods the different operations that can be done with http: get, post, and al...
...cies mostly involve specifying server origins and script endpoints. tools & resources helpful tools and resources for understanding and debugging http. firefox developer tools network monitor mozilla observatory a project designed to help developers, system administrators, and security professionals configure their sites safely and securely. redbot tools to check your cache-related headers how browsers work a very comprehensive article on browser internals and request flow through http protocol. a must-read for any web developer. ...

Creating custom Firefox extensions with the Mozilla build system - Archive of obsolete content
ich are used to generate normal c++ header files for inclusion in your source files. they can also be normal c++ header files that are to be used directly by other modules. the easiest way to accomplish the latter is to use inline implementations for all methods so you don't have any additional linking dependencies. otherwise you will have to link statically to your module if you use these public headers in other modules. personally i would discourage this practice (among other things, static linking means the same code gets loaded more than once into memory, and the code won't be available from javascript or other non-c++ languages) and encourage the use of xpcom wherever possible. the makefile in the public/ directory should follow this model: depth = ../../.. topsrcdir = @top...
... be overwritten by the second and you'll get ns_error_xpc_bad_iid errors when you try to access its idl interfaces from your code. the files under exports are copied directly to the /mozilla/$(moz_objdir)/dist/include/ directory and are thus accessible from other modules (the value of moz_objdir is defined in /mozilla/.mozconfig). xpidlsrcs are run through the idl processor, and the generated c++ headers are copied into the same include directory. in addition, an xpt (type library) file is generated and placed in the components/ subdirectory of your extension. source files now it's time to create the makefile and source files in the src/ subdirectory. if you're implementing interfaces that you've described using idl, the easiest way to do this is to leave the src/ directory empty an...

Migrating from Internal Linkage to Frozen Linkage - Archive of obsolete content
all these functions are now available via the new string api - appendutf16toutf8(srcstring, deststring); + deststring.append(ns_convertutf16toutf8(srcstring)); the signatures of the find methods differ between the two apis. if you are only finding a single character, prefer the findchar method. the (lossy)cop...
...e find methods instead. the tonewcstring, tonewunicode methods only work on the appropriate string class. you need to supply the appropriate conversion yourself. the adopt and getter_copies methods do not work on abstract strings. instead of passing getter_copies(astring) to a method expecting a character pointer out parameter, you will need to use a temporary variable and copy the result.missing headers some headers are included from idl files only when mozilla_internal_api is defined (actually, they shouldn't be there at all). for errors about undeclared do_createinstance: #include "nscomponentmanagerutils.h" for errors about undeclared do_getservice: #include "nsservicemanagerutils.h" for errors about undeclared ns_getspecialdirectory: #include "nsdirectoryserviceutils.h" utility classes so...

Intercepting Page Loads - Archive of obsolete content
r code in non-chrome objects (your xpcom service or jsm module). otherwise you have to make sure to avoid duplicated work if you have 2 or more windows open. there are 2 http topics you can listen to, as specified in the observer notifications page: topic description http-on-modify-request called as an http request is made. the channel is available to allow you to modify headers and such. http-on-examine-response called after a response has been received from the webserver. headers are available on the channel. the subject argument on the observe method is the nsihttpchannel object that corresponds to the http channel being opened or already opened, depending on the topic. observe : function(asubject, atopic, adata) { if (topic_modify_request == ato...
...xpression. asubject.setrequestheader("referer", "http://example.com", false); } else if (re_url_to_cancel.test(url)) { // re_url_to_cancel is a regular expression. asubject.cancel(components.results.ns_binding_aborted); } } } this example shows how you can obtain the url for the request, analyze it using regular expressions, and perform actions on it such as modifying http headers, or even canceling the request. http observers are great for load detection, and filtering by url. you can also use these in conjunction with nsitraceablechannel to get and modify the response text before it gets to the original requester. you won't be able to make dom modifications like with the load events, since these notifications are triggered before the response arrives and is parsed into...

Inner-browsing extending the browser navigation paradigm - Archive of obsolete content
r example, imagine a web form where users have to choose their city, by first selecting country then state. for example, imagine a web form where users have to choose their city, by first selecting country then state. updating the selects without refreshing the page provides a better user experience and bandwidth savings. webmail application the flexibility to easily access and manage all message headers in mail applications (like netscape mail or eudora) is probably one of the useful features when compared with web-based mail applications. in general, when a webmail account has more than a few messages, clicking 'next page' sends a request to the server. you receive a new page with the next block of message headers. on slow speed connections, this process can be slow and frustrating. with inner ...
...y one of the useful features when compared with web-based mail applications. in general, when a webmail account has more than a few messages, clicking 'next page' sends a request to the server. you receive a new page with the next block of message headers. on slow speed connections, this process can be slow and frustrating. with inner browsing, a simple request to retrieve the next set of message headers that replace the currently viewed message headers can dramatically improve user experience. implementing inner-browsing on top of html pages modern browsers have good support for the w3c dom and javascript allowing fine-grained control over page content. instead of forcing the reader to follow links to new pages, the javascript code can act as the mediator for information access. if the user clic...

Installing Dehydra - Archive of obsolete content
ish_decl patch wget https://bug559964.bugzilla.mozilla.o....cgi?id=457606 -o finish_decl.diff cd gcc-4.5.3 patch -p0 < ../finish_decl.diff # build gcc cd .. ...
...to enable static checking of a mozilla build, see building with static checking. ...

Hidden prefs - Archive of obsolete content
(displayname,c,@v)(firstname,c,@v)(lastname,c,@v))"); "and", "or" and "not" are valid. see http://lxr.mozilla.org/mozilla/sourc...drdatabase.idl for the list of valid attributes "c" == contains. see nsabquerystringtoexpression::createbooleanconditionstring() for other operators. mail composition "other header" pref ("mail.compose.other.header") the format for this a comma delimited list of mail headers, like "approved,x-no-archive" an example for your prefs.js would be: user_pref("mail.compose.other.header", "approved"); this will cause "approved" to show up in the compose window address picker, under to:, cc:, bcc:, newsgroup:, etc. for example: when that mail gets sent, approved: test@test.com will be in the message in the headers. this is a useful trick for newsgroup moderators who...
... collection pref("mail.collect_addressbook","moz-abmdbdirectory://abook.mab"); for the reasons why the defaults changed, see this document on the collected address book. ...

Message Summary Database - Archive of obsolete content
e the code can ignore but maintain the attributes it doesn't know about. if we were to replace mork, we could do it at the mdb level (unlikely, because implementing the mdb interface on top of a different db would be very hard), the nsimsgdatabase level (probably the easiest), or we could invent a whole new database interface and change all the code that uses the nsimsgdatabase interface. ...
...ikely, because implementing the mdb interface on top of a different db would be very hard), the nsimsgdatabase level (probably the easiest), or we could invent a whole new database interface and change all the code that uses the nsimsgdatabase interface. message headers the message header object implements the nsimsgdbhdr interface. this includes a set of per-message flags, the more commonly used headers (e.g., subject, sender, from, to, cc, date, etc), and a few other attributes, e.g., keywords. there are a set of generic property methods so that core code and extensions can set attributes on msg headers without changing nsimsghdr.idl.msg threads we store thread information persistently in the database and expose these object through the [nsimsgthread interface. so the db knows which messages ar...

Migrate apps from Internet Explorer to Mozilla - Archive of obsolete content
request(); myxmlhttprequest.open("get", "data.xml", true); myxmlhttprequest.onload = xmlloaded; myxmlhttprequest.send(null); } table 7 features a list of available methods and properties for mozilla's xmlhttprequest. table 7. xmlhttprequest methods and properties name description void abort() stops the request if it is still running. string getallresponseheaders() returns all response headers as one string. string getresponseheader(string headername) returns the value of the specified header. functionref onerror if set, the references function will be called whenever an error occurs during the request. functionref onload if set, the references function will be called when the request completes successfully and the r...
...lly, you can specify a username and password for the given url needed. int readystate state of the request. possible values: value description 0 uninitialized - open() has not been called yet. 1 loading - send() has not been called yet. 2 loaded - send() has been called, headers and status are available. 3 interactive - downloading, responsetext holds the partial data. 4 completed - finished with all operations. string responsetext string containing the response. domdocument responsexml dom document containing the response. void send(variant body) initiates t...

New Skin Notes - Archive of obsolete content
others do not have to hunt up "how". --callek add "what not to do" css class to stylesheet, as discussed on talk:core javascript 1.5 reference. what's the class called? --maian 21:08, 1 sep 2005 (pdt) in the new mw1.5 skin (not the one currently available here) there's class "wrong" and class "wrong-inline". those will be available after we do the wiki upgrades in the near future. --dria headers need a little padding. h1 could be smaller. --dria is it just me or visited links are not marked as such? --nickolay 07:16, 29 aug 2005 (pdt) imho the visited color looks horrible. we're a documentation site. there's no real reason for user to give him info that he already visited xml main page. it's hardly possible that he'll be interested in it. in all other dev centres there is no "visited ...
...erence). --nickolay do you know if there's a localsettings variable to have the edit-section links off by default? it appears that they're on by default right now. --dria yeah, i think we want them off by default, as the more common case for a reader will be to read documentation, not to edit it. --beltzner put these back in. will try to sort out how to change the default behaviour. --dria headers which are also links that point to as-yet-unwritten wiki pages are colored as though they actually do exist. for an example of this, see creating xpcom components. --waldo 21:09, 25 aug 2005 (pdt) not going to change (yet or possibly ever) adding pipes between buttons in horizontal nav-bar (ie: my talk | preferences | my watchlist) (stricken part is done). also, and this is a nit, it's a litt...

Using XPInstall to Install Plugins - Archive of obsolete content
tribute points directly to the xpi package, and if the browser can not identify any plugin to handle the (imaginary) application/x-myplugin mime type, it will download the xpi package. note: xpi packages (files with the xpi extension) use the application/x-xpinstall mime type. when serving xpi packages from servers to clients, make sure that xpi packages are served with this mime type in the http headers. associate the application/x-xpinstall mime type with xpi packages. the uninstall problem in its current iteration, xpinstall does not have an affiliated uninstall technology. it can therefore only be used to install files or deliver native code installers to the client, and if uninstall is a legitimate concern, it might be wise to write a native code (exe) uninstaller to remove the software. ...
...associate the application/x-xpinstall mime type with xpi packages. ...

Sorting Results - Archive of obsolete content
s are containers and just sort by a value, alphabetically or numerically depending on the type of data. when using a tree, sorting may be performed on each column of the tree. for instance, if a list of photos was displayed in a two column tree showing the title and description, you could sort by either title or description. the user can change the sort column and direction by clicking the column headers, however, you can programmatically change the sort as well. sorting tree results we'll examine sorting of trees first since trees are the most common element used with sorted items. using a tree builder, you can sort the results in a tree by a column. to do this, place a sort attribute on a treecol element referring to the variable to sort by for that column. <treecol id="name" label="name" sort=...
...a time. the value should be either 'ascending', 'descending' or 'natural'. this last value is the default if the attribute is not specified. the sortactive attribute may be set to true or false and specifies which column the tree is sorted by. only one column should have the sortactive attribute set to true at a time. the tree will change both attributes as necessary automatically when the column headers are clicked or the tree is sorted by other means. if you don't want to allow sorting by a certain column, you can leave out the sort attribute. only specify this attribute on columns that you wish to allow the user to sort by. here is a complete example of sorting a tree. the sort attribute should be set to the variable that holds the values to sort by. usually, this would be the same variable th...

Trees - Archive of obsolete content
r in a flat list or arranged into a hierarchy. a tree also allows the user to rearrange, resize and hide individual columns. some examples of trees include the list of messages in a mail application, or the bookmarks window in mozilla. in some ways, a tree has some similarities with the listbox. both can be used to create tables of data with multiple rows and columns, and both may contain column headers. the tree also supports nested rows, whereas the listbox does not. however, listboxes may contain any type of content, whereas trees may only contain text and images. (using advanced features, progress meters or checkboxes also can be added to the tree) a tree consists of two parts, the set of columns, and the tree body. the set of columns is defined by a number of treecol elements, one for e...
...g the label attribute. you may also want to make the columns flexible if your tree is flexible, so that the columns stretch as the tree does. in this example, the second column will be approximately twice as wide as the first column. all of the columns should be placed directly inside a treecols element. in this case we haven't specified a view to supply the tree's data, so we'll only see column headers and an empty tree body. you may have to resize the window to see anything since there isn't any data to display. since the tree has been marked as flexible, the body will stretch to fit the available space. making a tree flexible is quite commonly done, as it is often the case that the data in the tree is the most significant information displayed, so it makes sense to make the tree grow to fit. ...

XUL accessibility guidelines - Archive of obsolete content
f the application or the reading direction of the language. ensure that tab order is logical and all interactive elements can be accessed simply without the use of a mouse. you should be able to perform all functionality either directly in the application or through menu items or the context menu. trees provide alternative functionality for inaccessible operations. the column picker and column headers in xul trees are not keyboard accessible, consistent with the standard tree behavior on most contemporary operating systems. it is therefore necessary to provide a keyboard accessible alternative for accessing this functionality. the firefox "bookmarks manager" provides an example of how to make trees more accessible. the bookmark manager allows users to sort bookmarks by a particular column o...
...ndard tree behavior on most contemporary operating systems. it is therefore necessary to provide a keyboard accessible alternative for accessing this functionality. the firefox "bookmarks manager" provides an example of how to make trees more accessible. the bookmark manager allows users to sort bookmarks by a particular column of information and choose which columns to display. because column headers and the column picker, in the upper right hand corner of the tree, can not receive focus, they are not operable with a keyboard. in the bookmark manager this functionality is available under the view menu which is accessible to a keyboard user. toolbarbuttons by default, toolbar buttons cannot receive focus with a keyboard. the recommended way of fixing this is that all functionality associated...

tree - Archive of obsolete content
within the element by pressing keys corresponding to letters in the item's label. this is done incrementally, so typing more letters with select more specific items. this feature may be disabled by setting this attribute to true. editable type: boolean indicates that the cells of the tree may be edited. enablecolumndrag type: boolean when set to true, the user may drag the column headers around to change the order in which they are displayed. flags type: space-separated list of the values below a set of flags used for miscellaneous purposes. two flags are defined, which may be the value of this attribute. dont-test-empty: for template generated content, the builder will not check that a container is empty. dont-build-content: this flag may be used on a tree to indic...
...alue of the disablekeynavigation attribute. editingcolumn type: nsitreecolumn the column of the tree cell currently being edited, or null if there is no cell being edited. editingrow type: integer the row index of the tree cell currently being edited, or -1 if there is no cell currently being edited. enablecolumndrag type: boolean when set to true, the user may drag the column headers around to change the order in which they are displayed. firstordinalcolumn type: treecol element a reference to the first treecol element, which or may not be the first column displayed in the tree. inputfield type: textbox element read-only property that holds the textbox that is used for editing. seltype type: string gets and sets the value of the seltype attribute. ...

Client hints - MDN Web Docs Glossary: Definitions of Web-related terms
support client hints. servers announce support for client hints using the accept-ch (accept client hints) header or an equivalent html meta element with the http-equiv attribute. accept-ch: dpr, width, viewport-width, downlink and / or <meta http-equiv="accept-ch" content="dpr, width, viewport-width, downlink"> when a client receives the accept-ch header, if supported, it appends client hint headers that match the advertised field-values. for example, based on accept-ch example above, the client could append dpr, width, viewport-width, and downlink headers to all subsequent requests. in the second example, the server gives the browser the hints by setting the accept-ch meta tag. basically, with the client hints header, the developer or application can tell the browser to advertise informati...
...th. ...

Guard - MDN Web Docs Glossary: Definitions of Web-related terms
for more information, read fetch basic concepts: guard. ...
...for more information, read fetch basic concepts: guard. ...

Preflight request - MDN Web Docs Glossary: Definitions of Web-related terms
a cors preflight request is a cors request that checks to see if the cors protocol is understood and a server is aware using specific methods and headers. it is an options request, using three http request headers: access-control-request-method, access-control-request-headers, and the origin header. a preflight request is automatically issued by a browser and in normal cases, front-end developers don't need to craft such requests themselves. it appears when request is qualified as "to be preflighted" and omitted for simple requests. ...
...l cases, front-end developers don't need to craft such requests themselves. it appears when request is qualified as "to be preflighted" and omitted for simple requests. ...

Quality values - MDN Web Docs Glossary: Definitions of Web-related terms
the importance of a value is marked by the suffix ';q=' immediately followed by a value between 0 and 1 included, with up to three decimal digits, the highest value denoting the highest priority. when not present, the default value is 1. ...
... some syntax, like the one of accept, allow additional specifiers like text/html;level=1. these increase the specificity of the value. their use is extremely rare. browser-specific information firefox starting with firefox 18, the quality factor values are clamped to 2 decimal places. they used to be clamped to only 1 decimal place in earlier versions (bug 672448). more information http headers using q-values in their syntax: accept, accept-charset, accept-language, accept-encoding, te. ...

Response header - MDN Web Docs Glossary: Definitions of Web-related terms
a response header is an http header that can be used in an http response and that doesn't relate to the content of the message. response headers, like age, location or server are used to give a more detailed context of the response. not all headers appearing in a response are response headers. for example, the content-length header is an entity header referring to the size of the body of the response message. however, these entity requests are usually called responses headers in such a context. the following shows a few response headers after a get request. ...
... not all headers appearing in a response are response headers. for example, the content-length header is an entity header referring to the size of the body of the response message. however, these entity requests are usually called responses headers in such a context. the following shows a few response headers after a get request. ...

Sending form data - Learn web development
od, you get no data appended to the url, and the http request looks like so, with the data included in the request body instead: post / http/2.0 host: foo.com content-type: application/x-www-form-urlencoded content-length: 13 say=hi&to=mom the content-length header indicates the size of the body, and the content-type header indicates the type of resource sent to the server. we'll discuss these headers later on. note: you can find this example on github — see post-method.html (see it live also). viewing http requests http requests are never displayed to the user (if you want to see them, you need to use tools such as the firefox network monitor or the chrome developer tools). as an example, your form data will be shown as follows in the chrome network tab. after submitting the form: o...
...viewing http requests http requests are never displayed to the user (if you want to see them, you need to use tools such as the firefox network monitor or the chrome developer tools). as an example, your form data will be shown as follows in the chrome network tab. after submitting the form: open the developer tools. select "network" select "all" select "foo.com" in the "name" tab select "headers" you can then get the form data, as shown in the image below. the only thing displayed to the user is the url called. as we mentioned above, with a get request the user will see the data in their url bar, but with a post request they won't. this can be very important for two reasons: if you need to send a password (or any other sensitive piece of data), never use the get method or you ris...

Index - Learn web development
g html. 227 assessment: structuring planet data assessment, beginner, codingscripting, html, learn, tables in our table assessment, we provide you with some data on the planets in our solar system, and get you to structure it into an html table. 228 html table advanced features and accessibility accessibility, advanced, article, beginner, codingscripting, html, headers, learn, caption, nesting, scope, sumary, table, tbody, tfoot, thead there are a few other things you could learn about table html, but we have really given all you need to know at this moment in time. at this point, you might want to go and learn about styling html tables — see styling tables. 229 html table basics article, beginner, codingscripting, html, learn, tables, ba...
..., controls, example, forms, guide, html, web, widgets as you'll have seen in the last few articles, there are a lot of different types of available form element. you don't need to remember all of these details at once, and can return to these articles as often as you like to check up on details. 323 sending form data beginner, codingscripting, files, forms, guide, html, http, headers, security, web as we'd alluded to above, sending form data is easy, but securing an application can be tricky. just remember that a front-end developer is not the one who should define the security model of the data.it's possible to perform client-side form validation, but the server can't trust this validation because it has no way to truly know what has really happened on the client-side.

Website security - Learn web development
play a legitimate bank site but capture the login credentials into an invisible <iframe> controlled by the attacker. clickjacking could also be used to get the user to click a button on a visible site, but in doing so actually unwittingly click a completely different button. as a defense, your site can prevent itself from being embedded in an iframe in another site by setting the appropriate http headers. denial of service (dos). dos is usually achieved by flooding a target site with fake requests so that access to a site is disrupted for legitimate users. the requests may simply be numerous, or they may individually consume large amounts of resource (e.g., slow reads or uploading of large files). dos defenses usually work by identifying and blocking "bad" traffic while allowing legitimate messa...
...y of your website, you should sanitize all user-originating data before it is displayed in the browser, used in sql queries, or passed to an operating system or file system call. important: the single most important lesson you can learn about website security is to never trust data from the browser. this includes, but is not limited to data in url parameters of get requests, post requests, http headers and cookies, and user-uploaded files. always check and sanitize all incoming data. always assume the worst. a number of other concrete steps you can take are: use more effective password management. encourage strong passwords that are changed regularly. consider two-factor authentication for your site, so that in addition to a password the user must enter another authentication code (usually...

Mozilla’s UAAG evaluation report
ng css? html: tbody element (table): available through dom, can be styled using css? html: tfoot element (table): available through dom, can be styled using css? html: colgroup element (table): available through dom, can be styled using css? html: col element (table): available through dom, can be styled using css? html: scope attribute (table): available through dom html: headers attribute (table): available through dom html: axis attribute (table): available through dom html: tabindex attribute: yes, can be used to order sequential navigation html: accesskey attribute: supported with alt-{key}, menu key conflict favor the accesskey? html: alt for img: yes html: longdesc for img: yes, available in context menu properties html: alt for area: ? h...
... not really intended for end users (tasks, tools, dom inspector) 9.10 configure important elements. (p3) ni the navigational elements aren't user configurable guideline 10. orient the user. checkpoint title status notes/plans checkpoint title status notes/plans 10.1 table orientation. (p1) ni we don't make use of scope, headers, axis, or any other table accessibility features we have nothing under properties, or anywhere else, to orient users reading a table 10.2 highlight selection and content focus. (p1) vg provides a focus outline box highlights follow graphical rendering conventions for windows does not highlight selected images we do not have the ability to show a border around the te...

Makefile - targets
this article lists possible targets provided by the makefile. target name description build default target. compile firefox, thunderbird, etc check standalone shell unit test invoked directly by make configure launch the configure program to define headers and and attributes for the target build machine. ...
...le. target name description build default target. compile firefox, thunderbird, etc check standalone shell unit test invoked directly by make configure launch the configure program to define headers and and attributes for the target build machine. ...

How Mozilla's build system works
rder they are defined. typically, the traversal order looks something like base, nspr, nss, js, platform, app. each tier consists of three sub-tiers: export, libs, and tools. these sub-tiers roughly correspond to the actions of pre-build, main-build, and post-build. this naming, however, can be misleading because all three sub-tiers are part of the build: export is used to do things like copy headers into place. libs is reserved for most of the work, like compiling c++ source files. tools is used to install tests and other support tools. when make is invoked, it starts at the export sub-tier of the first tier, and traverses all the directories in that tier. then, it does the same thing for the libs sub-tier and, subsequently, the tools sub-tier. it then moves on to the next tier and conti...
... called continuation lines. a backslash as the last character on a line allows the variable definition to be continued on the next line. the extra whitespace is compressed. the terminating $(null) is a method for consistency; it allows you to add and remove lines without worrying about whether the last line has an ending backslash or not. ...

Gecko SDK
be accessed from xul using javascript. note that in order to develop such components, you do not need the full sources of e.g. firefox, since you do not access parts of the front end from within a component. furthermore, since a component contains basic functionality, it is intended to run with every product of the mozilla platform. therefore it makes no sense to use a particular product to build general functionality. that's the reason why the gecko sdk was devised. do not confuse the gecko/xulrunner sdk with xulrunner itself. ...
...devised. do not confuse the gecko/xulrunner sdk with xulrunner itself. the gecko sdk is a collection of header files and tools used to develop general xpcom components which add functionality to the existing platform, whereas xulrunner is a framework which can be used to run standalone or embedded applications based on the mozilla framework. the gecko sdk contains all of the necessary tools and headers for making scriptable npapi plugins including the xpidl compiler/linker and the latest npapi.h. get the sdk updates there is no need to download or rebuild the gecko sdk corresponding to security updates of mozilla (e.g., mozilla 1.7.3) since the headers and glue libs in the gecko sdk are usually not changed as a result of security updates. you do have to get and distribute the newest gecko co...

Creating a New Protocol
ll fit into the protocol hierarchy for multi-process plugins or tabs. the toplevel protocol for plugins is ppluginmodule. the toplevel protocol for tabs is pcontent. you should know what protocol will manage the new protocol and what lifetime issues that creates. if there is any doubt, ask on irc in the #content channel. building the new protocol to build the new protocol declaration and generate headers, make in ipc/ipdl: make -c objdir/ipc/ipdl if there are any protocol-level errors, the ipdl compiler will print the relevant error messages and stop. to view the generated headers, look in objdir/ipc/ipdl/_ipdlheaders . creating the implementation the c++ implementation inherits from the abstract ipdl-generated classes pnewprotocolparent and pnewprotocolchild. it must implement abstract methods ...
...writing the tests protocols which are managed by pbrowser must be tested using the mochitest-chrome test framework with a <browser remote="true">. it is acceptable to use synchronous calls on jpw wrappers for testing purposes. ...

IPDL Tutorial
state machine describing when messages are allowed to be sent. the parent actor is typically the more permanent side of the conversation: parent/child actors parent child ipc tabs chrome process content process ipc plugins content process plugin process each protocol is declared in a separate file. the ipdl compiler generates several c++ headers from each ipdl protocol. this generated code manages the details of the underlying communication layer (sockets and pipes), constructing and sending messages, ensuring that all actors adhere to their specifications, and handling many error conditions. the following ipdl code defines a very basic interaction of browser and plugin actors: async protocol pplugin { child: async init(nscstring plug...
...wn(); parent: async ready(); }; this code declares the pplugin protocol. two messages can be sent from the parent to the child, init() and shutdown(). one message can be sent from the child to the parent, ready(). ipdl protocols start with the letter p. the file in which the protocol is declared must have a matching name, pplugin.ipdl. generated c++ code when pplugin.ipdl is compiled, the headers ppluginparent.h, and ppluginchild.h will be generated in the ipc/ipdl/_ipdlheaders/ directory of the build tree. the ppluginparent and ppluginchild classes are abstract classes that must be subclassed. each outgoing message is a c++ method which can be called. each incoming message is a pure-virtual c++ method which must be implemented: class ppluginparent { public: bool sendinit(const nscstri...

Mozilla Web Developer FAQ
t-face is an at-rule. if @import is used, it should be the first thing in a css file. css parsing errors are reported to the javascript console. is the server sending the proper content-type header for css style sheets? the correct type is text/css. in the standards mode and the almost standards mode only style sheets with the correct type are applied. you can see the http headers sent by the server by using the livehttpheaders extension or by using the web sniffer. class names and ids are case-sensitive. the element selectors are case-sensitive with xml. style sheet processing instructions are only allowed in the prolog of xml documents. also, they only work in xml documents—not in documents served as text/html. width and height do not apply to non-replaced inl...
...e attributes. windows ie also shows the title attribute in a tooltip. does mozilla support downloadable fonts? downloadable fonts in truetype and opentype formats (.ttf and .otf) are supported since firefox 3.5. the fonts have to be served from the same origin (protocol, host, port) as the content that uses them unless the fonts are served with the appropriate cross-origin resource sharing http headers. downloadable fonts in the eot format are not supported. if you use downloadable fonts, please make sure the fonts have the right unicode mappings and the content uses the right unicode characters. the past practice of displaying non-latin text by assigning non-latin glyphs to latin code points breaks copying and pasting, breaks searching on the page, breaks indexing by search engines and break...

NSS API Guidelines
s #7, and pkcs #11) splitting low key and high key components more clearly the crypto wrappers (pkcs #11 wrappers) and high key pkcs #12 and pkcs #5 libraries nss compiles into the libraries described below. the layer indicates the main layer, seen in the previous diagram, in which the library operates. the directory is the location of the library code in the nss source tree. the public headers is a list of header files that contain types, and functions, that are publicly available to higer-level apis. library description layer directory public headers certdb provides all certificate handling functions and types. the certdb library manipulates the certificate database (add, create, delete certificates and crls). it also provides general certificate-hand...
...often reality is more complex. we would like to keep names to 8.3, even if we no longer support win16. this usually gives us four characters to identify a module of nss. in short: header files for consumption outside nss start with "nss." header files with types have a trailing "t", header files with prototypes don't. "extern" declarations of data also go in the prototypes files. "friend" headers are for things that we really wish weren't used by non-nss code, but which are. those files have a trailing "f," and their use should be deprecated. "module" headers are for things used only within a specific subset of nss; things which would have been "static" if we had combined separate c source files together. these header files have a trailing "m." functions and types there are a number o...

NSS Developer Tutorial
om to change them, but require applications to call nss functions, to allocate and free them. enums the numeric values of public enumerators cannot be changed. to stress this fact, we often explicitly assign numeric values to enumerators, rather than relying on the values assigned by the compiler. symbol export lists the manifest.mn file, in a directory in the nss source tree, specifies which headers are public, and which headers are private. public headers are in the exports variable. private headers,which may be included by files in other directories, are in the private_exports variable. private headers, that are only included by files in the same directory, are not listed in either variable. only functions listed in the symbol export lists (nss.def, ssl.def, smime.def, etc.) ar...
...the symbol export lists are the authoritative source of public functions. behavioral changes bug/quirk compatible: occasionally we cannot fix a bug, because applications may depend on the buggy behavior. we would need to add a new function to provide the desired behavior. similarly, new options often need to be disabled by default. ...

NSS Sample Code Sample_2_Initialization of NSS
nss sample code 2: initializing nss this example program demonstrates how to initialize the nss database. this program illustrates password handling. ...
... nss sample code 2: initializing nss this example program demonstrates how to initialize the nss database. this program illustrates password handling. ...

Hashing - sample 1
nss sample code 1: hashing. the nss same code below computes the hash of a file and saves it to another file, this illustrates the use of nss message apis. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...
...of a file and saves it to another file, this illustrates the use of nss message apis. /* this source code form is subject to the terms of the mozilla public * license, v. 2.0. if a copy of the mpl was not distributed with this * file, you can obtain one at http://mozilla.org/mpl/2.0/. ...

NSS_3.12.3_release_notes.html
bug 464406: fix signtool regressions bug 465270: uninitialised value in devutil.c::create_object() bug 465273: dea...
...e in ocsp tests. bug 484425: need accessor function to retrieve symkey handle bug 484466: sec_error_invalid_args with nss_enable_pkix_verify=1 bug 485127: bltest crashes when attempting rc5_cbc or rc5_ecb bug 485140: wrong command line flags used to build intel-aes.s with solaris gas for x86_64 bug 485370: crash bug 485713: files added by red hat recently have missing texts in license headers. bug 485729: remove lib/freebl/mapfile.solaris bug 485837: vc90.pdb files are output in source directory instead of objdir bug 486060: sec_asn1d_parse_leaf uses argument uninitialized by caller pbe_pk11algidtoparam documentation for a list of the primary nss documentation pages on mozilla.org, see nss documentation. new and revised documents available since the release of nss 3.11 includ...

Necko walkthrough
ctions in which channel responses are received asynchronously. nshttpchannel::asyncopen called from openuri; openchannel isn't named the best, since the opening happens in the context of openuri, its calling function. this is where it hits necko code. but the interface for clients of necko is important to consider: send request uri helps creates channel setup channel (headers, request data, response callback...) channel->asyncopen. receive response get a callback to each of these: nsistreamlistener::onstartrequest (header info) nsistreamlistener::ondataavailable (data in single or multiple chunks) nsistreamlistener::onstoprequest (no more data from http) this all happens on the main thread, in a non-blocking fashion: m...
...channel checks if we're proxying or not fires off the dns prefetch request (dispatched to dns thread pool) some other things nshttpchannel::connect might to a speculativeconnect (pre open tcp socket) nshttpchannel::continueconnect some cache stuff nshttpchannel::setuptransaction creates new nshttptransaction, and inits it with mrequesthead (the request headers) and muploadstream (which was created from the request data in channel setup) gets an nsiasyncinputstream (for the response; corresponds to the nspipeinputstream for the response stream pipe) passes it to nsinputstreampump nshttpchannel::ghttphandler->initiatetransaction (called from connect) this is the global nshttphandler object, which adds the transaction to the nshttpconnec...

Parser API
terface letexpression <: expression { type: "letexpression"; head: [ variabledeclarator ]; body: expression; } a let expression. note: the let expression form is spidermonkey-specific. patterns interface pattern <: node { } javascript 1.7 introduced destructuring assignment and binding forms. all binding forms (such as function parameters, variable declarations, and catch block headers) accept array and object destructuring patterns in addition to plain identifiers. the left-hand sides of assignment expressions can be arbitrary expressions, but in the case where the expression is an object or array literal, it is interpreted by spidermonkey as a destructuring pattern. since the left-hand side of an assignment can in general be any expression, in an assignment context, a patter...
...ignment expressions can be arbitrary expressions, but in the case where the expression is an object or array literal, it is interpreted by spidermonkey as a destructuring pattern. since the left-hand side of an assignment can in general be any expression, in an assignment context, a pattern can be any expression. in binding positions (such as function parameters, variable declarations, and catch headers), patterns can only be identifiers in the base case, not arbitrary expressions. interface objectpattern <: pattern { type: "objectpattern"; properties: [ { key: literal | identifier, value: pattern } ]; } an object-destructuring pattern. a literal property in an object pattern can have either a string or number as its value. interface arraypattern <: pattern { type: "arraypattern"...

ROLE_TABLE
also refer to the following roles: role_columnheader, role_rowheader, role_column, role_row, role_cell. ...
...also refer to the following roles: role_columnheader, role_rowheader, role_column, role_row, role_cell. ...

Finishing the Component
this functionality should be exposed to embedders and component developers, so the apis are not ready to be published. this puts you in the same situation as many developers using mozilla - you want to use some specific functionality, but the interfaces seem to change on a daily basis. all of the mozilla source code is publicly available, and interfaces can be used easily enough. grab the right headers, use the component or service manager to access the interface you want, and the xpcom object(s) that implement that interface will do your bidding. with this huge amount of flexibility, however, you lose compatibility. if you use "stuff" that isn't frozen, that stuff is subject to change in future versions of gecko. if you want to be protected against changes in gecko, you must only use interfac...
... interfaces marked with such a tag. even with interfaces marked "under review," however, it's still a good idea to contact the module owners responsible for the interfaces you are interested in using. copying interfaces into your build environment to get and implement interfaces that are not part of gecko in your component, simply create a new directory in the gecko sdk named unfrozen. copy the headers and idl files that you need from the content/base/public source directory of the gecko build into this new directory. (for weblock, all you need are the headers for nsicontentpolicy and the nsicontentpolicy.idl.) then, using the same steps you used to create the weblock.h, create a header from this idl file using the xpidl compiler. once you have these interface and header files, you can modify t...

Mozilla internal string guide
most of the mozilla code uses a c++ class hierarchy to pass string data, rather than using raw pointers. this guide documents the string classes which are visible to code within the mozilla codebase (code which is linked into libxul). introduction the string classes are a library of c++ classes which are used to manage buffers of wide (16-bit) and narrow (8-bit) character strings. the headers and implementation are in the xpcom/string directory. all strings are stored as a single contiguous buffer of characters. the 8-bit and 16-bit string classes have completely separate base classes, but share the same apis. as a result, you cannot assign a 8-bit string to a 16-bit string without some kind of conversion helper class or routine. for the purpose of this document, we will refer to the 1...
...ored in utf-16 may require one or two 16-bit char16_ts in a string class. the contents of nsastring always has to be regarded as in this encoding instead of ucs2. utf-16 is capable of representing the entire unicode character repertoire, and it efficiently maps to utf-32. (win32 w apis and mac os x natively use utf-16.) latin1 - 8-bit encoding for the first 256 unicode code points. used for http headers and for size-optimized storage in text node and spidermonkey strings. latin1 converts to utf-16 by zero-extending each byte to a 16-bit code unit. note that this kind of "latin1" is not available for encoding html, css, js, etc. specifying charset=latin1 means the same as charset=windows-1252. windows-1252 is a similar but different encoding used for interchange. in addition, there exist multip...

IAccessibleTable
long column, [out] long ncolumnsspanned ); parameters row 0 based row index of the accessible for which to return the column extent. column 0 based column index of the accessible for which to return the column extent. ncolumnsspanned returns the 1 based column extent of the specified cell. return value e_invalidarg if bad [in] passed, [out] value is 0. s_ok. columnheader() returns the column headers as an iaccessibletable object. content and size of the returned table are implementation dependent. [propget] hresult columnheader( [out] iaccessibletable accessibletable, [out] long startingrowindex ); parameters accessibletable the column header. startingrowindex the 0 based row index where the header starts, usually 0. return value s_false if there is no header, [out] values are null an...
...tat( [in] long row, [in] long column, [out] long nrowsspanned ); parameters row 0 based row index of the accessible for which to return the row extent. column 0 based column index of the accessible for which to return the row extent. nrowsspanned returns the row extent of the specified cell. return value e_invalidarg if bad [in] passed, [out] value is 0. s_ok. rowheader() returns the row headers as an iaccessibletable object. content and size of the returned table are implementation dependent. [propget] hresult rowheader( [out] iaccessibletable accessibletable, [out] long startingcolumnindex ); parameters accessibletable the row header. startingcolumnindex the 0 based column index where the header starts, usually 0. return value s_false if there is no header, [out] values are null...

IAccessibleTableCell
e([out] iunknown table ); methods columnextent() returns the number of columns occupied by this cell accessible. the result is greater than 1 if the specified cell spans multiple columns. [propget] hresult columnextent( [out] long ncolumnsspanned ); parameters ncolumnsspanned returns the 1 based column extent of the specified cell. return value s_ok. columnheadercells() returns the column headers as an array of cell accessibles. [propget] hresult columnheadercells( [out, size_is(, ncolumnheadercells,)] iunknown cellaccessibles, [out] long ncolumnheadercells ); parameters cellaccessibles pointer to an array of references to cell accessibles. the array is allocated by the server. free it with cotaskmemfree. ncolumnheadercells the number of accessibles returned; the size of the returne...
... columnextents number of cells spanned by this cell in this column. isselected indicates if the specified cell is selected. return value s_ok. rowextent() returns the number of rows occupied by this cell accessible. [propget] hresult rowextent( [out] long nrowsspanned ); parameters nrowsspanned returns the row extent of the specified cell. return value s_ok. rowheadercells() returns the row headers as an array of cell accessibles. [propget] hresult rowheadercells( [out, size_is(, nrowheadercells,)] iunknown cellaccessibles, [out] long nrowheadercells ); parameters cellaccessibles pointer to an array of references to cell accessibles. the array is allocated by the server. free it with cotaskmemfree. nrowheadercells the number of accessibles returned; the size of the returned array. re...

nsIMimeConverter
inherits from: nsisupports implemented by: @mozilla.org/messenger/mimeconverter;1. ...
... in boolean structured, in string mailcharset, in long fieldnamelen, in long encodedwordsize); parameters header the string to encode into the mime-encoded form. structured whether or not this string may contain <> blocks which should not be encoded (e.g., the from and to headers). mailcharset the charset to encode into. fieldnamelen the length of the header field including the colon and space (": "). encodedwordsize the maximum line length of the encoded string. decodemimeheadertocharptr() void setstringproperty(in string propertyname, in string propertyvalue); parameters propertyname the name of the property to set. propertyvalue...

nsIMsgDBHdr
in clear, if you want to do a persistent change to a message header, such as marking it as read, or replied to, or whatever, you must do it through its corresponding nsimsgfolder (msghdr.folder) or nsimsgdatabase (msghdr.folder.msgdatabase). ...
...in clear, if you want to do a persistent change to a message header, such as marking it as read, or replied to, or whatever, you must do it through its corresponding nsimsgfolder (msghdr.folder) or nsimsgdatabase (msghdr.folder.msgdatabase). ...

nsIMsgFilterList
defined in comm-central/ mailnews/ base/ search/ public/ nsimsgfilterlist.idl attributes folder attribute nsimsgfolder nsimsgfilterlist::folder version readonly attribute short nsimsgfilterlist::version arbitraryheaders readonly attribute acstring nsimsgfilterlist::arbitraryheaders shoulddownloadallheaders readonly attribute boolean nsimsgfilterlist::shoulddownloadallheaders filtercount readonly attribute unsigned long nsimsgfilterlist::filtercount loggingenabled attribute boolean nsimsgfilterlist::loggingenabled defaultfile attribute nsilocalfile nsimsgfilterlist::defaultfile logstream attribute nsioutputstream nsimsgfilterlist::logstream logurl readonly attribute acstring nsimsgfilterlist::logurl methods getfilterat() nsimsgfilter nsimsgfilterlist::getfilterat (in unsigned lo...
...terlist::parsecondition ( in nsimsgfilter afilter, in string condition ) savetodefaultfile() void nsimsgfilterlist::savetodefaultfile ( ) applyfilterstohdr() void nsimsgfilterlist::applyfilterstohdr ( in nsmsgfiltertypetype filtertype, in nsimsgdbhdr msghdr, in nsimsgfolder folder, in nsimsgdatabase db, in string headers, in unsigned long headersize, in nsimsgfilterhitnotify listener, in nsimsgwindow msgwindow, in nsilocalfile amessagefile ) writeinattr() void nsimsgfilterlist::writeintattr ( in nsmsgfilterfileattribvalue attrib, in long value, in nsioutputstream stream ) writestrattr() void nsimsgf...

nsIMsgFolder
ame acstring readonly expungedbytes unsigned long readonly deletable boolean readonly: can this folder be deleted. for example, special folders cannot be deleted. displayrecipients boolean readonly: should we be displaying recipients instead of the sender. for example, in the sent folder, recipients are more relevant than the sender. manyheaderstodownload boolean readonly: used to determine if it will take a long time to download all the headers in this folder - so that we can do folder notifications synchronously instead of asynchronously. requirescleanup boolean readonly hasnewmessages boolean does this folder have new messages. firstnewmessage nsimsgdbhdr readonly: the first new messa...
... nsmsgdispositionstate_forwarded 1 allmessagecountnotifications 0 turn notifications on/off for various notification types. currently only supporting allmessagecountnotifications which refers to both total and unread message counts. methods startfolderloading() void startfolderloading(); endfolderloading() void endfolderloading(); updatefolder() get new headers for the database. void updatefolder(nsimsgwindow awindow); getfilterlist() get the filter list on folder's server (or in the case of news, the filter list for this newsgroup). nsimsgfilterlist getfilterlist(nsimsgwindow msgwindow); setfilterlist() void setfilterlist(in nsimsgfilterlist filterlist); forcedbclosed() void forcedbclosed(); delete() void delete(); deletesubfolders...

nsIMsgHeaderParser
usernames); astring makefulladdress(in astring aname, in astring aaddress); string makefulladdressstring(in string aname, in string aaddress); wstring makefulladdresswstring(in wstring name, in wstring addr); obsolete since gecko 1.9 void parseheaderaddresses(in string line, out string names, out string addresses, out pruint32 numaddresses); void parseheaderswitharray(in wstring aline, [array, size_is(count)] out wstring aemailaddresses, [array, size_is(count)] out wstring anames, [array, size_is(count)] out wstring afullnames, [retval] out unsigned long count); void reformatheaderaddresses(in string line, out string reformattedaddress); wstring reformatunquotedaddresses(in wstring line); void removeduplicateaddresses(in str...
...ant this part of the result. addresses a string of the addresses in the header line. the addresses are separated by null-terminators. this param may be null if the caller does not want this part of the result. numaddresses the number of addresses in the header. if this is negative, there has been an error parsing the header. exceptions thrown missing exception missing description parseheaderswitharray() void parseheaderswitharray( in wstring aline, [array, size_is(count)] out wstring aemailaddresses, [array, size_is(count)] out wstring anames, [array, size_is(count)] out wstring afullnames, [retval] out unsigned long count ); parameters aline the header line to parse. aemailaddresses missing description anames missing description afullnames missing description ...

nsIUploadChannel
inputstream get the stream (to be) uploaded by this channel. read only. methods setuploadstream() sets a stream to be uploaded by this channel. most implementations of this interface require that the stream: implement threadsafe addref and release implement nsiinputstream.readsegments() implement nsiseekablestream.seek(). history here is that we need to support both streams that already have headers (for example, content-type and content-length) information prepended to the stream (by plugins) as well as clients (composer, uploading application) that want to upload data streams without any knowledge of protocol specifications. for this reason, we have a special meaning for the acontenttype parameter. void setuploadstream( in nsiinputstream astream, in acstring acontenttype, in long aco...
... to upload data streams without any knowledge of protocol specifications. for this reason, we have a special meaning for the acontenttype parameter. void setuploadstream( in nsiinputstream astream, in acstring acontenttype, in long acontentlength ); parameters astream the stream to be uploaded by this channel. acontenttype if acontenttype is empty, the protocol will assume that no content headers are to be added to the uploaded stream and that any required headers are already encoded in the stream. in the case of http, if this parameter is non-empty, then its value will replace any existing content-type header on the http request. in the case of ftp and file, this parameter is ignored. acontentlength a value of -1 indicates that the length of the stream should be determined by calling the...

pyxpidl
the pyxpidl tool suite has been built to replace the older xpidl tool which, in the past, was used to turn xpidl files into c++ headers and xpcom typelibs (xpt files). the newer utility has the advantage of not needing any code to be compiled in order to use it, and let us remove a bunch of old code from the tree. pyxpidl has been in use for a while, but replaced xpidl in the gecko sdk starting in gecko 9.0. using pyxpidl pyxpidl is in the sdk in the sdkdir/sdk/bin/ directory. unlike xpidl, which combined all the functions into a single utility, pyxpidl is comprised of two utilities: header.py, which generates c++ headers from idl, and typelib.py, which generates xpt files. pyxpidl requires a directory to cache certain information in. you can use a temporary directory or the current ...
... sdkdir/sdk/bin/ directory. unlike xpidl, which combined all the functions into a single utility, pyxpidl is comprised of two utilities: header.py, which generates c++ headers from idl, and typelib.py, which generates xpt files. pyxpidl requires a directory to cache certain information in. you can use a temporary directory or the current directory or whatever works best for you. generating c++ headers to generate c++ headers, use the header.py utility: sdkdir/sdk/bin/header.py --cachedir=<path> -o <outputfilename.h> <filename.idl> generating typelibs generating typelib files is done using the typelib.py utility: sdkdir/sdk/bin/typelib.py --cachedir=<path> -o <outputfilename.xpt> <filename.idl> comparing pyxpidl to xpidl this table provides a mapping of old xpidl options to pyxpidl. ...

Message Interfaces
it is a child of nsimsghdr (see above). nsimsgthread nsimsgthread - this interface is used to interact with threads in thunderbird. ...
...it is a child of nsimsghdr (see above). nsimsgthread nsimsgthread - this interface is used to interact with threads in thunderbird. ...

Migrating from Firebug - Firefox Developer Tools
t information both firebug and the firefox devtools' network monitor allow you to inspect the information about a request by clicking on it. the only difference is that firebug shows the information below the request while the network monitor displays it within a side panel. in both tools there are different tabs containing different kinds of information for the selected request. they contain a headers, params, response and cookies panel. a preview of the response is shown within specifically named panels like html. the network monitor has a preview panel for this purpose. it doesn't provide information about the cached data yet (see bug 859051), but provides a security tab in addition to firebug's information and a timings tab showing detailed information about the network timings. view reque...
...ers detailed information about the network timings related to a request by hovering the timeline column within its net panel. the network monitor shows this information within a timings side panel when you select a request. view remote address the remote address of a request is shown within the remote ip column within firebug. in the network monitor the address is shown at remote address in the headers tab when a request is selected. search within requests the search field within firebug allows to search within the requests. the search field in the firefox devtools filters the requests by the entered string. firebug allowed to search within the response body of the network requests by checking response bodies within its search field options. this feature is not available yet within the netwo...

Tips - Firefox Developer Tools
lick the import button () to import a style sheet or the create button () to create a new one. click the options button in the style sheet pane and click "show original sources" to toggle the display of css preprocessor files. network monitor click the request summary to compare performance of cache vs. no-cache page loading. when a request is selected click "edit and resend" to modify its headers and send it again. check "enable persistent logs" in the settings to keep requests from before even after navigation. hover the "js" icon within the "cause" column to see the javascript stack trace, which caused the request. check "disable http cache (when toolbox is open)" in the settings to disable the network cache while debugging network issues. storage inspector right-click the colum...
...nd send it again. check "enable persistent logs" in the settings to keep requests from before even after navigation. hover the "js" icon within the "cause" column to see the javascript stack trace, which caused the request. check "disable http cache (when toolbox is open)" in the settings to disable the network cache while debugging network issues. storage inspector right-click the column headers to open a menu allowing to toggle the display of the columns. right-click an entry and click "delete name" to delete it or "delete all" to delete all entries. select an entry to see the parsed value of it in the sidebar. ...

Console messages - Firefox Developer Tools
he browser loaded this display content. see mixed content for more details. this site specified both an x-content-security-policy/report-only header and a content-security-policy/report-only header. the x-content-security-policy/report-only header(s) will be ignored. see content security policy for more details. the x-content-security-policy and x-content-security-report-only headers will be deprecated in the future. please use the content-security-policy and content-security-report-only headers with csp spec compliant syntax instead. see content security policy for more details. password fields present on an insecure (http://) page. this is a security risk that allows user login credentials to be stolen. pages containing login forms must be served over https, ...
...ay it works is: your server-side code — python, php, node.js, etc. — includes a library that provides a console api. your server-side code uses this api to log messages. the server-side library creates json objects from the messages and encodes them for transmission. the messages are transmitted to the client as a response header named x-chromelogger-data. the web console decodes these headers and displays them. to find a suitable library for your server code, see the chrome logger documentation. interpreter input/output commands sent to the browser using the web console's javascript interpreter, and the corresponding responses, are logged in the console messages. for responses that contain objects or variables, the following context menu options are available: reveal in inspec...

Fetch API - Web APIs
s: the promise returned from fetch() won’t reject on http error status even if the response is an http 404 or 500. instead, it will resolve normally (with ok status set to false), and it will only reject on network failure or if anything prevented the request from completing. fetch() won't can receive cross-site cookies; you can’t can establish a cross site session using fetch. set-cookie headers from other sites are silently ignored. fetch() won’t send cookies, unless you set credentials: 'same-origin'. in august 2017, the spec changed the default credentials policy to 'same-origin'. the following browsers shipped and outdated native fetch, and were updated in these versions: firefox version 61.0b13. safari version 12. chrome version 68. if you ar...
...fetch basic concepts. aborting a fetch browsers have started to add experimental support for the abortcontroller and abortsignal interfaces (aka the abort api), which allow operations like fetch and xhr to be aborted if they have not already completed. see the interface pages for more details. fetch interfaces windoworworkerglobalscope.fetch() the fetch() method used to fetch a resource. headers represents response/request headers, allowing you to query them and take different actions depending on the results. request represents a resource request. response represents the response to a request. fetch mixin body provides methods relating to the body of the response/request, allowing you to declare what its content type is and how it should be handled. specifications ...

PerformanceServerTiming - Web APIs
ng.nameread only a domstring value of the server-specified metric name. methods performanceservertiming.tojson() returns a domstring that is the json representation of the performanceservertiming object. ...
...ation of the performanceservertiming object. ...

ReadableStream.cancel() - Web APIs
used to cancel the stream — the job is finished so it is no longer needed. ...
... living standard initial definition. ...

Request.cache - Web APIs
) .then(function(response) { /* consume the response */ }); // download a resource with cache busting, but update the http // cache with the downloaded resource. fetch("some.json", {cache: "reload"}) .then(function(response) { /* consume the response */ }); // download a resource with cache busting when dealing with a // properly configured server that will send the correct etag // and date headers and properly handle if-modified-since and // if-none-match request headers, therefore we can rely on the // validation to guarantee a fresh response. fetch("some.json", {cache: "no-cache"}) .then(function(response) { /* consume the response */ }); // download a resource with economics in mind! prefer a cached // albeit stale response to conserve as much bandwidth as possible. fetch("some.json...
... typeerror && e.message === "failed to fetch" ? ({status: 504}) : // workaround for chrome; which simply fails with a typeerror promise.reject(e)) .then(res => { if (res.status === 504) { controller.abort() controller = new abortcontroller(); return fetch("some.json", {cache: "force-cache", mode: "same-origin", signal: controller.signal}) } const date = res.headers.get("date"), dt = date ? new date(date).gettime() : 0 if (dt < (date.now() - 86400000)) { // if older than 24 hours controller.abort() controller = new abortcontroller(); return fetch("some.json", {cache: "reload", mode: "same-origin", signal: controller.signal}) } // other possible conditions if (dt < (date.now() - 300000)) // if it's older than 5 minutes...

Request.mode - Web APIs
ar mymode = request.mode; value a requestmode value. the associated mode, available values of which are: same-origin — if a request is made to another origin with this mode set, the result is simply an error. you could use this to ensure that a request is always being made to your origin. no-cors — prevents the method from being anything other than head, get or post, and the headers from being anything other than simple headers. if any serviceworkers intercept these requests, they may not add or override any headers except for those that are simple headers. in addition, javascript may not access any properties of the resulting response. this ensures that serviceworkers do not affect the semantics of the web and prevents security and privacy issues arising from leaking data a...
...vascript may not access any properties of the resulting response. this ensures that serviceworkers do not affect the semantics of the web and prevents security and privacy issues arising from leaking data across domains. cors — allows cross-origin requests, for example to access various apis offered by 3rd party vendors. these are expected to adhere to the cors protocol. only a limited set of headers are exposed in the response, but the body is readable. navigate — a mode for supporting navigation. the navigate value is intended to be used only by html navigation. a navigate request is created only while navigating between documents. default mode requests can be initiated in a variety of ways, and the mode for a request depends on the particular means by which it was initiated. fo...

Response - Web APIs
response to a request. you can create a new response object using the response.response() constructor, but you are more likely to encounter a response object being returned as the result of another api operation—for example, a service worker fetchevent.respondwith, or a simple windoworworkerglobalscope.fetch(). constructor response() creates a new response object. properties response.headers read only the headers object associated with the response. response.ok read only a boolean indicating whether the response was successful (status in the range 200–299) or not. response.redirected read only indicates whether or not the response is the result of a redirect (that is, its url list has more than one entry). response.status read only the status code of the response. (this ...
...not. response.redirected read only indicates whether or not the response is the result of a redirect (that is, its url list has more than one entry). response.status read only the status code of the response. (this will be 200 for a success). response.statustext read only the status message corresponding to the status code. (e.g., ok for 200). response.trailers a promise resolving to a headers object, associated with the response with response.headers for values of the http trailer header. response.type read only the type of the response (e.g., basic, cors). response.url read only the url of the response. response.usefinalurl a boolean indicating whether this is the final url of the response. body interface properties response implements body, so it also has the following pr...

Using XMLHttpRequest - Web APIs
some file <input> fields, when you submit a form through the formdata api you do not need to use the filereader api also: files are automatically loaded and uploaded. ...
...*/ ifhaschanged("yourpage.html", function (nmodif, nvisit) { console.log("the page '" + this.filepath + "' has been changed on " + (new date(nmodif)).tolocalestring() + "!"); }); if you want to know if the current page has ch...

XMLHttpRequest.setRequestHeader() - Web APIs
d several times with the same header, the values are merged into one single request header. each time you call setrequestheader() after the first time you call it, the specified text is appended to the end of the existing header's content. if no accept header has been set using this, an accept header with the type "*/*" is sent with the request when send() is called. ...
...ged into one single request header. each time you call setrequestheader() after the first time you call it, the specified text is appended to the end of the existing header's content. if no accept header has been set using this, an accept header with the type "*/*" is sent with the request when send() is called. for security reasons, some headers can only be controlled by the user agent. these headers include the forbidden header names and forbidden response header names. note: for your custom fields, you may encounter a "not allowed by access-control-allow-headers in preflight response" exception when you send requests across domains. in this situation, you need to set up the access-control-allow-headers in your response header at server side. syntax xmlhttprequest.setrequestheader(head...

XMLHttpRequest - Web APIs
lly being terminated. xmlhttprequesteventtarget.ontimeout is an eventhandler that is called whenever the request times out. xmlhttprequest.upload read only is an xmlhttprequestupload, representing the upload process. xmlhttprequest.withcredentials is a boolean that indicates whether or not cross-site access-control requests should be made using credentials such as cookies or authorization headers. non-standard properties xmlhttprequest.channelread only is a nsichannel. the channel used by the object when performing the request. xmlhttprequest.mozanonread only is a boolean. if true, the request will be sent without cookie and authentication headers. xmlhttprequest.mozsystemread only is a boolean. if true, the same origin policy will not be enforced on the request. xmlhttprequ...
...mplemented in various browsers (onload, onerror, onprogress, etc.). see using xmlhttprequest. more recent browsers, including firefox, also support listening to the xmlhttprequest events via standard addeventlistener() apis in addition to setting on* properties to a handler function. methods xmlhttprequest.abort() aborts the request if it has already been sent. xmlhttprequest.getallresponseheaders() returns all the response headers, separated by crlf, as a string, or null if no response has been received. xmlhttprequest.getresponseheader() returns the string containing the text of the specified header, or null if either the response has not yet been received or the header doesn't exist in the response. xmlhttprequest.open() initializes a request. xmlhttprequest.overridemimetype() ov...

ARIA Test Cases - Accessibility
- zoom (leopard) pass n/a pass pass zoomtext - - - - orca - - - - grid see various grid and table examples on the example page for grid variants. basic grid -- single select grid in an application -- single select illinois grid example -- multi select expected at behavior: screen reader should read column and row headers as the grid is traversed with arrow keys (in forms mode). screen readers should continue to respect any special table reading modes while the user traverses the grid. for example, while in the grid in forms mode, the user should be able to configure the screen reader to read row headers only. jaws - virtual cursor - jaws treats a grid as if it were an html table. all table keys are act...
... jawskey+ctrl+semicolon keystroke displays a list of landmarks in the current page. semicolon and shift+semicolon move to next landmark and move to previous landmark respectively. markup used: role = (one of the following): "application", "article", "banner", "complementary...

ARIA: table role - Accessibility
id instead. note: using a native html table element whenever possible is strongly encouraged. associated wai-aria roles, states, and properties role="rowgroup" an optional child of the table, the row group encapsulates a group of rows, similar to thead, tbody, and tfoot. role="row" a row within the table, and optionally within a rowgroup, that is a container for one or more cells, columnheaders, or rowheaders. aria-describedby attribute takes as its value the id of the element that serves as a description for the table. aria-label attribute the aria-label provides an accessible name for the table. aria-colcount attribute this attribute is only required if the columns are not present in the dom all the time. it provides an explicit indication of the number of columns in the full ...
... </div> <div role="row" aria-rowindex="24"> <span role="cell">term</span> <span role="cell">dt</span> </div> </div> </div> the above is part of a table. while the full table has 81 entries, as indicated by the aria-rowcount property, only four are currently visible. the columns are sortable, but not currently sorted, as indicated by the aria-sort property on the column headers. best practices only use table, tbody, thead, tr, th, td, etc., for data table structure. you can add these aria roles to ensure accessibility should the native semantics of the table be removed, such as with css. a relevant use case for the aria table role is when css's display property overrides the native semantics of a table, such as by display: grid. in this case, you can use the aria tabl...

WAI-ARIA Roles - Accessibility
lethe region landmark role is used to identify an area in the document that the author has identified as significant. it is used to provide a generic landmark for people to be able to navigate to easily when none of the other landmark roles are appropriate.aria: row rolean element with role="row" is a row of cells within a tabular structure. ...
...olean element with role="row" is a row of cells within a tabular structure. a row contains one or more cells, grid cells or column headers, and possibly a row header, within a grid, table or treegrid, and optionally within a rowgroup.aria: rowgroup rolean element with role="rowgroup" is a group of rows within a tabular structure. a rowgroup contains one or more rows of cells, grid cells, column headers, or row headers within a grid, table or treegrid.aria: search rolethe search landmark role is used to identify a section of the page used to search the page, site, or collection of sites.aria: suggestion rolethe suggestion landmark role semantically denotes a single proposed change to an editable document. this should be used on an element that wraps an element with an insertion role, and one wit...

Viewport concepts - CSS: Cascading Style Sheets
ment.documentelement.clientwidth /* 800 */ window.innerwidth /* 800 */ window.outerwidth /* 800 in firefox, 1200 in chrome */ document.documentelement.clientheight /* 533 */ window.innerheight /* 533 */ window.outerheight /* 596 in firefox, 900 in chrome */ the viewport was originally 1200 x 800 pixels. upon zooming in, the viewport became 800 x 533 pixels. this is the layout viewport. sticky headers or footers, with the following styles, will stick to the top and bottom of the layout viewport respectively. body > header { position: fixed; top: 0; } body > footer { position: fixed; bottom: 0; } we got the 800 x 533 measurement when we zoomed in using the keyboard. the header and footer stayed flush against the top and bottom of the window. but what if we had pinched-zoomed on a tab...
...ps open on a phone? the web contains two viewports, the layout viewport and the visual viewport. the visual viewport is the part of the web page that is currently visible in the browser and can change. when the user pinch-zooms the page, pops open a dynamic keyboard, or when a previously hidden address bar becomes visible, the visual viewport shrinks but the layout viewport is unchanged. sticky headers or footers, as discussed above, stick to the top and bottom of the layout viewport, and therefore remain in view when we zoom in with the keyboard. if you pinch-zoom, the layout viewport may not be fully visible. if you magnify from the middle of the layout viewport, the content would expand in all four directions. if you had a sticky header or footer, they would still be stuck to the top or bott...

<tbody>: The Table Body element - HTML: Hypertext Markup Language
ize, and a thicker, darker bottom border than the other cell borders. result the resulting table looks like this: multiple bodies you can create multiple sections within a table by using multiple <tbody> elements. each may potentially have its own header row or rows; however, there can be only one <thead> per table! because of that, you need to use a <tr> filled with <th> elements to create headers within each <tbody>. let's see how that's done. let's take the previous example, add some more students to the list, and update the table so that instead of listing each student's major on every row, the students are grouped by major, with heading rows for each major. result first, the resulting table, so you know what we're building: html the revised html looks like this: <table> <thea...
...", sans-serif; } th, td { border: 1px solid #bbb; padding: 2px 8px 0; text-align: left; } thead > tr > th { background-color: #cce; font-size: 18px; border-bottom: 2px solid #999; } most of the css is unchanged. we do, however, add a slightly more subtle style for header cells contained directly within a <tbody> (as opposed to those which reside in a <thead>). this is used for the headers indicating each table section's corresponding major. tbody > tr > th { background-color: #dde; border-bottom: 1.5px solid #bbb; font-weight: normal; } specifications specification status comment html living standardthe definition of 'tbody element' in that specification. living standard html5the definition of 'tbody element' in that specification. ...

<th> - HTML: Hypertext Markup Language
the source for this interactive example is stored in a github repository. if you'd like to contribute to the interactive examples project, please clone https://github.com/mdn/interactive-examples and send us a pull request. content categories none. permitted content flow content, but with no header, footer, sectioning content, or heading content descendants. tag omission the start tag is mandatory. ...
...ntains a short abbreviated description of the cell's content. some user-agents, such as speech readers, may present this description before the content itself. colspan this attribute contains a non-negative integer value that indicates for how many columns the cell extends. its default value is 1. values higher than 1000 will be considered as incorrect and will be set to the default value (1). headers this attribute contains a list of space-separated strings, each corresponding to the id attribute of the <th> elements that apply to this element. rowspan this attribute contains a non-negative integer value that indicates for how many rows the cell extends. its default value is 1; if its value is set to 0, it extends until the end of the table section (<thead>, <tbody>, <tfoot>, even if impli...

Using the application cache - HTML: Hypertext Markup Language
rised of zero or more space and tab characters. comment comments consist of zero or more tabs or spaces followed by a single # character, followed by zero or more characters of comment text. comments may only be used on their own lines (after the initial cache manifest line), and cannot be appended to other lines. this means that you cannot specify fragment identifiers. section header section headers specify which section of the cache manifest is being manipulated. there are three possible section headers: section header description cache: switches to the explicit section of the cache manifest (this is the default section). network: switches to the online whitelist section of the cache manifest. fallback: switches to the fallback section of t...
...ed. you must update the cache manifest file itself before the browser retrieves and uses the updated files. you can do this programmatically using window.applicationcache.swapcache(), though resources that have already been loaded will not be affected. to make sure that resources are loaded from a new version of the application cache, refreshing the page is ideal. it's a good idea to set expires headers on your web server for *.appcache files to expire immediately. this avoids the risk of caching manifest files. for example, in apache you can specify such a configuration as follows: expiresbytype text/cache-manifest "access plus 0 seconds" ...

MIME types (IANA media types) - HTTP
heora is the usual video codec used within it; vorbis is the usual audio codec. multipart/form-data the multipart/form-data type can be used when sending the values of a completed html form from browser to server. as a multipart document format, it consists of different parts, delimited by a boundary (a string starting with a double dash --). ...
...e used when sending the values of a completed html form from browser to server. as a multipart document format, it consists of different parts, delimited by a boundary (a string starting with a double dash --). each part is its own entity with its own http headers, content-disposition, and content-type for file uploading fields. ...

Basics of HTTP - HTTP
articles overview of http describes what http is and its role in web architecture, including its position in the protocol stack. ...
....1 was the first version of http to support persistent connection and pipelining. this article explains both concepts. connection management in http/2 http/2 completely revisited how connections are created and maintained. this article explains how http frames allow multiplexing and solve the 'head-of-line' blocking problem of former http versions. content negotiation http introduces a set of headers, starting with accept as a way for a browser to announce the format, language, or encoding it prefers. this article explains how this advertisement happens, how the server is expected to react, and how it chooses the most adequate response. ...

Content Security Policy (CSP) - HTTP
der to a web page and giving it values to control what resources the user agent is allowed to load for that page. for example, a page that uploads and displays images could allow images from anywhere, but restrict a form action to a specific endpoint. a properly designed content security policy helps protect a page against a cross site scripting attack. this article explains how to construct such headers properly, and provides examples. specifying your policy you can use the content-security-policy http header to specify your policy, like this: content-security-policy: policy the policy is a string containing the policy directives describing your content security policy. writing a policy a policy is described using a series of policy directives, each of which describes the policy for a cert...
...e revision to a policy without actually deploying it. you can use the content-security-policy-report-only http header to specify your policy, like this: content-security-policy-report-only: policy if both a content-security-policy-report-only header and a content-security-policy header are present in the same response, both policies are honored. the policy specified in content-security-policy headers is enforced while the content-security-policy-report-only policy generates reports but is not enforced. enabling reporting by default, violation reports aren't sent. to enable violation reporting, you need to specify the report-uri policy directive, providing at least one uri to which to deliver the reports: content-security-policy: default-src 'self'; report-uri http://reportcollector.example...

HTTP caching - HTTP
ignored; when the cache receives a request for a stale resource, it forwards this request with a if-none-match to check if it is in fact still fresh. if so, the server returns a 304 (not modified) header without sending the body of the requested resource, saving some bandwidth. here is an example of this process with a shared cache proxy: the freshness lifetime is calculated based on several headers. if a "cache-control: max-age=n" header is specified, then the freshness lifetime is equal to n. if this header is not present, which is very often the case, it is checked if an expires header is present. if an expires header exists, then its value minus the value of the date header determines the freshness lifetime. finally, if neither header is present, look for a last-modified header. if this ...
...modified header is present in a response, then the client can issue an if-modified-since request header to validate the cached document. when a validation request is made, the server can either ignore the validation request and response with a normal 200 ok, or it can return 304 not modified (with an empty body) to instruct the browser to use its cached copy. the latter response can also include headers that update the expiration time of the cached document. varying responses the vary http response header determines how to match future request headers to decide whether a cached response can be used rather than requesting a fresh one from the origin server. when a cache receives a request that can be satisfied by a cached response that has a vary header field, it must not use that cached respo...

Connection - HTTP
e, the connection is persistent and not closed, allowing for subsequent requests to the same server to be done. connection-specific header fields such as connection and keep-alive are prohibited in http/2. chrome and firefox ignore them in http/2 responses, but safari conforms to the http/2 spec requirements and won’t load any response which contains them. except for the standard hop-by-hop headers (keep-alive, transfer-encoding, te, connection, trailer, upgrade, proxy-authorization and proxy-authenticate), any hop-by-hop headers used by the message must be listed in the connection header, so that the first proxy knows it has to consume them and not forward them further. standard hop-by-hop headers can be listed too (it is often the case of keep-alive, but this is not mandatory). ...
... can be listed too (it is often the case of keep-alive, but this is not mandatory). header type general header forbidden header name yes syntax connection: keep-alive connection: close directives close indicates that either the client or the server would like to close the connection. this is the default on http/1.0 requests. any comma-separated list of http headers [usually keep-alive only] indicates that the client would like to keep the connection open. having a persistent connection is the default on http/1.1 requests. the list of headers are the name of the header to be removed by the first non-transparent proxy or cache in-between: these headers define the connection between the emitter and the first entity, not the destination node. ...

Device-Memory - HTTP
evice memory api header that works like client hints header which represents the approximate amount of ram client device has. header type request header forbidden header name ? note: client hints are accessible only on secure origins (via tls). server has to opt in to receive device-memory header from the client by sending accept-ch and accept-ch-lifetime response headers. ...
... accept-ch: device-memory accept-ch-lifetime: 86400 then on subsequent requests the client might send device-memory header back: device-memory: 1 specifications specification status comment device memory 1the definition of 'device-memory' in that specification. ...

Link - HTTP
it is semantically equivalent to the html <link> element. syntax link: < uri-reference >; param1=value1; param2="value2" <uri-reference> the uri reference, must be enclosed between < and >. parameters the link header contains parameters, which are separated with ; and are equivalent to attributes of the <link> element. ...
...k: https://bad.example; rel="preconnect" specifying multiple links you can specify multiple links separated by commas, for example: link: <https://one.example.com>; rel="preconnect", <https://two.example.com>; rel="preconnect", <https://three.example.com>; rel="preconnect" specifications specification status comments rfc 8288, section 3: link serialisation in http headers ietf rfc rfc 5988, section 5: the link header field ietf rfc initial definition ...

X-Content-Type-Options - HTTP
this is a way to opt out of mime type sniffing, or, in other words, to say that the mime types are deliberately configured. this header was introduced by microsoft in ie 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable mime types into executable mime types. since then, other browsers have introduced it, even if their mime sniffing algorithms were less aggressive. ...
... types. since then, other browsers have introduced it, even if their mime sniffing algorithms were less aggressive. starting with firefox 72, the opting out of mime sniffing is also applied to top-level documents if a content-type is provided. this can cause html web pages to be downloaded instead of being rendered when they are served with a mime type other than text/html. make sure to set both headers correctly. site security testers usually expect this header to be set. note: x-content-type-options only apply request-blocking due to nosniff for request destinations of "script" and "style". however, it also enables cross-origin read blocking (corb) protection for html, txt, json and xml files (excluding svg image/svg+xml). header type response header forbidden header na...

HEAD - HTTP
if the response to a head request shows that a cached url response is now outdated, the cached copy is invalidated even if no get request was made. ...
... if the response to a head request shows that a cached url response is now outdated, the cached copy is invalidated even if no get request was made. ...

Proxy servers and tunneling - HTTP
make requests appear as if they originated from the proxy's ip address. this can be useful if a proxy is used to provide client anonymity, but in other cases information from the original request is lost. the ip address of the original client is often used for debugging, statistics, or generating location-dependent content. a common way to disclose this information is by using the following http headers: the standardized header: forwarded contains information from the client-facing side of proxy servers that is altered or lost when a proxy is involved in the path of the request. or the de-facto standard versions: x-forwarded-for identifies the originating ip addresses of a client connecting to a web server through an http proxy or a load balancer. x-forwarded-host identifies the...
...uested that a client used to connect to your proxy or load balancer. x-forwarded-proto identifies the protocol (http or https) that a client used to connect to your proxy or load balancer. to provide information about the proxy itself (not about the client connecting to it), the via header can be used. via added by proxies, both forward and reverse proxies, and can appear in the request headers and the response headers. http tunneling tunneling transmits private network data and protocol information through public network by encapsulating the data. http tunneling is using a protocol of higher level (http) to transport a lower level protocol (tcp). the http protocol specifies a request method called connect. it starts two-way communications with the requested resource and can be used...

HTTP Public Key Pinning (HPKP) - HTTP
e of two months and include all subdomains. it is advised to verify that this setup will work for your server. hpkp has the potential to lock out users for a long time if used incorrectly! the use of backup certificates and/or pinning the ca certificate is recommended. apache adding a line similar to the following to your webserver's config will enable hpkp on your apache. this requires mod_headers enabled. header always set public-key-pins "pin-sha256=\"base64+primary==\"; pin-sha256=\"base64+backup==\"; max-age=5184000; includesubdomains" nginx adding the following line and inserting the appropriate pin-sha256="..." values will enable hpkp on your nginx. this requires the ngx_http_headers_module. add_header public-key-pins 'pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; ...
...pin-sha256=\"base64+primary==\"; pin-sha256=\"base64+backup==\"; max-age=5184000; includesubdomains") note: this requires the mod_setenv server.module loaded which can be included by the following if not already loaded. server.modules += ( "mod_setenv" ) iis add the following line to the web.config file to send the public-key-pins header: <system.webserver> ... <httpprotocol> <customheaders> <add name="public-key-pins" value="pin-sha256=&quot;base64+primary==&quot;; pin-sha256=&quot;base64+backup==&quot;; max-age=5184000; includesubdomains" /> </customheaders> </httpprotocol> ... </system.webserver> specifications specification title rfc 7469, section 2.1: public-key-pins public key pinning extension for http ...

How to make PWAs re-engageable using Notifications and Push - Progressive web apps (PWAs)
e second one is the applicationserverkey, which contains our successfully acquired and converted vapid key. return registration.pushmanager.subscribe({ uservisibleonly: true, applicationserverkey: convertedvapidkey }); now let's move to the subscription part — the app first sends the subscription details as json to the server using fetch. ...
...nthandlers.onclick function on the subscribe button is defined: document.getelementbyid('doit').onclick = function() { const payload = document.getelementbyid('notification-payload').value; const delay = document.getelementbyid('notification-delay').value; const ttl = document.getelementbyid('notification-ttl').value; fetch('./sendnotification', { method: 'post', headers: { 'content-type': 'application/json' }, body: json.stringify({ subscription: subscription, payload: payload, delay: delay, ttl: ttl, }), }); }; when the button is clicked, fetch asks the server to send the notification with the given parameters: payload is the text that to be shown in the notification, delay...

page-worker - Archive of obsolete content
main add-on code for a complete solution. for example, the content script might read some content and send it back to the main add-on, which could store it using the simple-storage api. you can communicate with the script using either the postmessage() api or (preferably, usually) the port api. ...

tabs - Archive of obsolete content
f the favicon for the page currently loaded in the tab. this property is read-only. this property is deprecated. from version 1.15, use the favicon module's getfavicon() function instead. contenttype this is currently an experimental api, so we might change it in future releases. returns the mime type that the document currently loaded in the tab is being rendered as. this may come from http headers or other sources of mime information, and might be affected by automatic type conversions performed by either the browser or extensions. this property is read-only. index the index of the tab relative to other tabs in the application window. this property can be set to change its relative position. ispinned whether or not this tab is pinned as an app tab. this property is read-only. window ...

Dialogs and Prompts - Archive of obsolete content
/> <button dlgtype="cancel"/> </vbox> </hbox> </dialog> default button since firefox 1.5, there are defaultbutton attributes and properties on the <dialog> element bug 284776. the possible values for the attribute are the names of buttons listed above, and the default is "accept", for compatibility with previous versions. using <dialogheader> you can use the dialogheader element to add "headers" to windows. to get an idea of what it looks like, open options (or preferences) dialog in firefox or thunderbird (v1.0 and earlier only). the header to the right of the sections buttons is made with <dialogheader>: <dialogheader title="general" description="whatever"/> note, that you should only use this element in a <dialog>, because otherwise it may be not styled properly. (although it seems...

Setting Up a Development Environment - Archive of obsolete content
ery buggy. it is specially unreliable when debugging code in javascript xpcom and xbl files. nevertheless, it is a valuable tool when trying to figure out why a certain function is misbehaving. tamper data tamper data intercepts http requests and their responses. it allows you to cancel them and even replace payload data before it is sent. there are several similar extensions, such as live http headers, but tamper data is the one that we use the most. we'll cover more on http debugging later on. firebug the firebug extension includes pretty much all tools mentioned so far, but it's mostly focused on web development. the chromebug extension helps in making firebug more useful for extension development, but it may still not be powerful enough to replace all of the previously mentioned add-ons. ...

An Interview With Douglas Bowman of Wired News - Archive of obsolete content
page layout accomplished with simple css positioning; vastly increased accessibility without special coding or user agent detection. why did you pursue a standards-based redesign of wired news? as network design manager at lycos for the last two years, i've been creating and documenting design standards for our network of sites. this includes rules and guidelines applying to everything from headers, footers, page hierarchy, titles, typography, iconography, navigation, and others. so i'm very familiar with standards and the benefits of using them. with the wired news design process, the scenario was reversed. as i was designing the product, i began discovering a broader set of web standards, and was quickly swayed by the advantages i could see if we were to adopt them. it was a no-brainer t...

progress - Archive of obsolete content
canbubble boolean does the event normally bubble? read only. cancelable boolean is it possible to cancel the event? read only. lengthcomputable boolean specifies whether or not the total size of the transfer is known. read only. loaded unsigned long (long) the number of bytes transferred since the beginning of the operation. this doesn't include headers and other overhead, but only the content itself. read only. total unsigned long (long) the total number of bytes of content that will be transferred during the operation. if the total size is unknown, this value is zero. read only. related events checking noupdate downloading progress cached updateready obsolete error ...

In-Depth - Archive of obsolete content
wo controls to look different from the operating systems defaults. ...

Dehydra Frequently Asked Questions - Archive of obsolete content
e the cfg functionality, this functionality is now provided by treehydra. what is the status of gcc 4.5 support? development version of dehydra should work with gcc 4.5 on any c++ codebase. if you encounter bugs or crashes, report them. where does one report dehydra bugs? use this link to file bugs. for crashes reports attach a minimized input file. use either a source files that rely on standard headers or a compressed .ii file (pass -save-temps to gcc to get .ii files). where can i find js code for real-life analyses for dehydra? please see static checking scripts on mozilla-central. note that some of the analyses may require treehydra. please see building with static checking for more information about static checking builds in mozilla. does dehydra provide any adts such as map/set? yes. see l...

Modularization techniques - Archive of obsolete content
m on windows? because it's not a cross platform solution, and that's what we need. we're going to make every effort to make our interfaces compatible with com on platforms that support it, so it may not matter. but no promises, yet. what are the major differences? instead of microsoft's midl compiler, we are using a corba-compliant idl compiler, xpidl. it outputs nspr types when generating c++ headers. it also generates typelibraries that are not compatible with microsoft's .tlb format. xpcom uses these typelibraries to allow other languages, such as javascript, to implement and call xpcom objects. we also do cross-thread proxying calls using the typelib and nspr's event queues. microsoft provides an extensive support infrastructure for com. this technology is built into windows, but not most...

New Security Model for Web Services - Archive of obsolete content
ecify "any" as the type to permit any requested type of access to resources. the principle uri of the script will be checked for the specified uri prefix. if "from" is not specified, then all scripts will be allowed. note: one can also use wild charater(s) in "from" value. for example: <wsa:allow type="soapv" from="http://www.mozilla.org"/> this command allows soap requests with verification headers from scripts loaded from the domain www.mozilla.org. <wsa:allow type="soapv" from="http://*.mozilla.org"/> this command allows soap requests with verification headers from scripts loaded from the domain with host name containing mozilla.org. that is, http://www.mozilla.org/, http://lxr.mozilla.org, http://komodo.mozilla.org, etc. will be granted access. implementation nsiwebscriptsaccessserv...

Table Cellmap - Archive of obsolete content
address. if the address is odd then it holds some other info (mbits). easy table cellmap just imagine a 2x2 table. <table> <tr><td>cell 1</td><td>cell 2</td></tr> <tr><td>cell 3</td><td>cell 4</td></tr> </table> this would create a cellmap with two rows and in each row 2 entries. each entry in the cellmap wold have a direct link to the corresponding tablecellframes. tables with footers, headers etc. take the same table and adder a header <table> <thead> <tr><td>head cell 1</td><td>head cell 2</td></tr> </thead> <tbody> <tr><td>cell 1</td><td>cell 2</td></tr> <tr><td>cell 3</td><td>cell 4</td></tr> </tbody> </table> now we have two different rowgroups and and the rowspans can not cross the borders between the different rowgroups. (ref xhtml-2.0). further the table header and...

enableColumnDrag - Archive of obsolete content
...

enableColumnDrag - Archive of obsolete content
...

List Controls - Archive of obsolete content
</listitem> <listitem> <listcell label="mary ellen" /> <listcell label="candle maker" /> </listitem> <listitem> <listcell label="roger" /> <listcell label="swashbuckler" /> </listitem> </listbox> header rows list boxes also allow a special header row to be used. this is much like a regular row except that it is displayed differently. you would use this to create column headers. two new elements are used. the listhead element is used for the header rows, just as the listitem element is used for regular rows. the header row is not a normal row however, so using a script to get the first row in the list box will skip the header row. the listheader element is used for each cell in the header row. use the label attribute to set the label for the header cell. here is the ear...

More Tree Features - Archive of obsolete content
sufficient to indicate this, as you may have a container that has no children but should still be treated like a container. for example, a directory with no files in it should still be treated like a container whereas a file should not. more about tree columns one additional attribute you can add to the tree is enablecolumndrag. (note the mixed case.) if set to true, the user may drag the column headers around to rearrange the order of the columns. a user will also likely want to change the column widths. you can do this by placing a splitter element in between each treecol element. a small notch will appear in between each column header which the user may drag to change the width of a column. you can use the style class tree-splitter to hide the notch, although the column may still be resized. ...

Styling a Tree - Archive of obsolete content
style added to the tree element will apply to the entire tree. adding a style to the treecol element does not cause the style to be applied to the column but only to the header. the body of the tree must be styled in a somewhat different way than other elements. this is because the tree body is stored in a different way to other elements. the outer treechildren is the only real element in the tree body. the inner elements are just placeholders. ...

Trees and Templates - Archive of obsolete content
ful for certain datasources where the data is determined dynamically. sorting columns if you try the previous example, you might note that the list of files is not sorted. trees which generate their data from a datasource have the optional ability to sort their data. you can sort either ascending or descending on any column. the user may change the sort column and direction by clicking the column headers. this sorting feature is not available for trees with static content, although you can write a script to sort the data. sorting involves three attributes, which should be placed on the columns. the first attribute, sort, should be set to an rdf property that is used as the sort key. usually, this would be the same as that used in the label of the cell in that column. if you set this on a column, ...

Writing Skinnable XUL and CSS - Archive of obsolete content
verlayed into other components. below are examples for each case. example 1: the navigator package has a personal toolbar with popup menu buttons. the colors for the toolbar and buttons should be drawn from global by placingclass attributes on the appropriate elements in the xul. there should be no rules in navigator.css that attempt to define colors, fonts, etc. for either the personal toolbar headers or for the menu buttons' borders. example 2: the messenger package has a css file that describes the appearance of the messenger button that appears on the taskbar used by all windows. the messenger css file should not attempt to describe the borders or the colors for this button. it should only describe the icon. because the button is used in the navigator window (through overlays), the fonts...

XUL Accesskey FAQ and Policies - Archive of obsolete content
etter of the first word in the prompt. next, try the first letter of another word in the prompt. finally, use any non-silent letter in an action word (do these after the rest of the dialog has accesskeys chosen). common elements that don't get accesskeys ok buttons. cancel buttons. close buttons. tab panel labels. toolbar buttons tree items list items column headers are there any crucial bugs i should know about? bug 143065 - scope of accesskeys is not limited to the current tab panel. where do accesskeys need to be added? look for dependencies of bug 129179 (the xul accesskey hookup meta bug), or look for bugs with "accesskey" or "mnemonic" in the summary, or look for dialogs where there are no elements with underlined letters. file bugs under the ...

The Implementation of the Application Object Model - Archive of obsolete content
tent that exists on top of the pluggable data sources and that exists underneath the content tree nodes that implement the interfaces through which the data is actually exposed. let's go back to the sorting problem and consider a hypothetical situation. suppose we decide we want to cache the sort relationship on our data, so that we don't have to continually resort it as the user hits the column headers in the tree. what we really need in this situation is the ability to take our intermediate representation and form an entirely different set of connections between our data objects. we need the ability to use arcs of a different type to connect our nodes, e.g., rather than chaining the nodes using a "natural order" relationship, it would be advantageous and desirable to be able to add an addition...

Using SOAP in XULRunner 1.9 - Archive of obsolete content
< req.setrequestheader("soapserver", soapclient.soapserver); < req.setrequestheader("soapaction", soapreq.action); < } < }); --- > var xhr = new xmlhttprequest(); > xhr.mozbackgroundrequest = true; > xhr.open('post', soapclient.proxy, true); > xhr.onreadystatechange = function() { > if (4 != xhr.readystate) { return; } > getresponse(xhr); > }; > var headers = { > 'method': 'post', > 'content-type': soapclient.contenttype + '; charset="' + > soapclient.charset + '"', > 'content-length': soapclient.contentlength, > 'soapserver': soapclient.soapserver, > 'soapaction': soapreq.action > }; > for (var h in headers) { xhr.setrequestheader(h, headers[h]); } > xhr.send(content); ...

nsIContentPolicy - Archive of obsolete content
the content policy and should not be used outside gecko code. type_refresh 8 indicates a timed refresh. shouldload() will never get this, because it does not represent content to be loaded (the actual load triggered by the refresh will go through shouldload() as expected). shouldprocess() will get this for, for example <meta> refresh elements and http refresh headers. type_xbl 9 indicates an xbl binding request, triggered either by -moz-binding css property or the document.addbinding() method. type_ping 10 indicates a ping triggered by a click on an <a> element using the ping attribute. type_xmlhttprequest 11 indicates an xmlhttprequest. also used for document.load() type_object_subrequest 12 indicat...

2006-10-06 - Archive of obsolete content
goals, roadmap and available communication channels, etc), tools needed to start developing and building tb, documentation on source structure as well as links to help one get started on the project. david bienvenu suggests a top down architectural description of tb's data structures along with documentation about extracting them. brian king also mentions that documentation on handling message headers on the ui side would be helpful. cédric corazza recommends that the proposed documention should be made available on the l10n cvs once it reaches a decent stage so that localizers can get a head-start on the localization before the final version is made available. updated : need ui to rearrange tags peter lairo suggested some ui should be available for rearranging tags. related: bug 342065...

Extentsions FAQ - Archive of obsolete content
ed tags. they replace the old labels (although the labels are still recognised). preserved properties source code - nsimapmailfolder::copymessages uaq friday, september 22 - 29, 2006 (↑ top) why extension preferences do not get changed until after it's upgrade? why extension preferences do not get changed until after it's upgrade? is there a way of changing the thunderbird displays headers when replying and forwarding? why there are some rss feeds that do not appear as livemarks when bookmarked even though the necessary tags for the feed to appear as a livemark are seemingly present and properly formatted in the feeds source? asking for help in knowing the data that is typed into text boxes. asking about the feasibility of making an extension that has the same functionalit...

NPN_PostURL - Archive of obsolete content
the flag file to false, the buffer buf to the data to post, and len to the length of buffer. possible url types include http (similar to an html form submission), mail (sending mail), news (posting a news article), and ftp (upload a file). plug-ins can use this function to post form data to cgi scripts using http or upload files to a remote server using ftp. you cannot use npn_posturl to specify headers (even a blank line) in a memory buffer. to do this, use npn_posturlnotify. for protocols in which the headers must be distinguished from the body, such as http, the buffer or file should contain the headers, followed by a blank line, then the body. if no custom headers are required, simply add a blank line ('\n') to the beginning of the file or buffer. npn_posturl is typically asynchronous: it re...

NPN_PostURLNotify - Archive of obsolete content
ubsequent npp_urlnotify call, which returns this value (see description below). returns if successful, the function returns nperr_no_error. if unsuccessful, the plug-in is not loaded and the function returns an error code. for possible values, see error codes. description npn_posturlnotify functions identically to npn_posturl, with these exceptions: npn_posturlnotify supports specifying headers when posting a memory buffer. npn_posturlnotify calls npp_urlnotify upon successful or unsuccessful completion of the request. for more information, see npn_posturl. npn_posturlnotify is typically asynchronous: it returns immediately and only later handles the request and calls npp_urlnotify. if this function is called with a target parameter value of _self or a parent to _self, this function ...

NPP_GetValue - Archive of obsolete content
for information. syntax #include <npapi.h> nperror npp_getvalue(void *instance, nppvariable variable, void *value); parameters the function has the following parameters: instance pointer to the plugin instance from which the value should come. variable variable for which the browser (caller) would like a value. the full list is in the npapi headers. value value for the requested variable. returns if successful, the function returns nperr_no_error. if unsuccessful, the function returns an error code. for possible values, see error codes. description npp_getvalue retrieves instance variables. see also npp_setvalue, npn_getvalue, npn_setvalue ...

Writing a plugin for Mac OS X - Archive of obsolete content
info.plist file, which is packaged in the plugin bundle. the plugin also communicates its bundle type in that file, under the key cfbundlepackagetype; the type is 'brpl'. if the type isn't an npapi plugin type, the bundle won't load as an npapi plugin. you can always just use 'brpl'. xp_macosx it's important to define the gcc preprocessor definition xp_macosx to 1; this is used by the npapi headers to build properly on mac os x. if you don't define it, they won't be interpreted correctly. this is easy to miss in the sample project's build settings. symbol visibility symbol visibility is a common problem for people trying to get npapi plugins working. some symbols must be visible as standard c symbols so the browser can find them, which means they need to be prefixed by an underscore, a...

NSPR Release Engineering Guide - Archive of obsolete content
ub_release_x_y_z_beta beta release checkout a whole new tree using the tag from above build all targets, debug and optimized on all platforms using the command: gmake release mdist=<dir>/mdist build_number=vx.y.z [build_opt=1 | use_debug_rtl=1] copy the bits from mdist to /share/builds/components/nspr20/.vx.y.z 1 run explode.pl run the test suite on all targets, using binaries & headers from shipped bits resolve testing anomalies tag the tree with nsprpub_release_x_y[_z] release candidate checkout a whole new tree using tag (including fixes) tag the treey with nsprpub_release_x_y_z build all targets, debug and optimized on all platforms using the command: gmake release mdist=<dir>/mdist build_number=vx.y.z [build_opt=1 | use_debug_rtl=1] copy the bits from ...

Obsolete: XPCOM-based scripting for NPAPI plugins - Archive of obsolete content
ms devstudio midl must not be used. (let's assume 'testplugin' as a plugin name-place holder.) compile nsitestplugin.idl with the idl compiler. this will generate nsitestplugin.h and nsitestplugin.xpt files. put nsitestplugin.xpt to the components folder. build nptestplugin.dll with nsitestplugin.h included for compiling scriptable instance cla...

Gecko FAQ - Gecko Redirect 1
velopment project working to support, and to what extent does it support them? ...

CORS-safelisted request header - MDN Web Docs Glossary: Definitions of Web-related terms
a cors-safelisted request header is one of the following http headers: accept, accept-language, content-language, content-type. when containing only these headers (and values that meet the additional requirements laid out below), a requests doesn't need to send a preflight request in the context of cors. you can safelist more headers using the access-control-allow-headers header and also list the above headers there to circumvent the following additional restrictions: additional restrictions cors-safelisted headers must also fulfill the following requirements in order to be a cors-safelisted request header: for accept-language and content-language: can only have values consisting of 0-9, a-z, a-z, space or *,-.;=. for accept and content-type: can't contain a cors-unsafe req...

General header - MDN Web Docs Glossary: Definitions of Web-related terms
a general header is an http header that can be used in both request and response messages but doesn't apply to the content itself. depending on the context they are used in, general headers are either response or request headers. however, they are not entity headers. the most common general headers are date, cache-control or connection. ...

Packet - MDN Web Docs Glossary: Definitions of Web-related terms
k packet, is a formatted chunk of data sent over a network. the maincomponents of a network packet are the user data and control information. the user data is known as the payload. the control information is the information for delivering the payload. it consists of network addresses for the source and destination, sequencing information, and error detection codes and is generally found in packet headers and footer. a packet contains: hop limit a hop occurs when a packet is passed from one network to the next network. it is a field that is decreases by one each time a packet goes through, once it reaches 0 it has failed and the packet is discarded. over time the number packets can cause traversing within closed circuits, the number of pa ckets circulating would build up and then ult...

Prefetch - MDN Web Docs Glossary: Definitions of Web-related terms
dns-prefetch" href="https://example.com/"> link prefetching link prefetching is a performance optimization technique that works by assuming which links the user is likely to click, then downloading the content of those links. if the user decides to click on one of the links, then the page will be rendered instantly as the content has already been downloaded. the prefetch hints are sent in http headers: link: ; rel=dns-prefetch, ; as=script; rel=preload, ; rel=prerender, ; as=style; rel=preload prefetch attribute value browsers will prefetch content when the prefetch <link> tag directs it to, giving the developer control over what resources should be prefetched. <link rel="prefetch" href="https://www.example.com/solutions" /> ...

Proxy server - MDN Web Docs Glossary: Definitions of Web-related terms
a proxy server is an intermediate program or computer used when navigating through different networks of the internet. they facilitate access to content on the world wide web. a proxy intercepts requests and serves back responses; it may forward the requests, or not (for example in the case of a cache), and it may modify it (for example changing its headers, at the boundary between two networks). a proxy can be on the user's local computer, or anywhere between the user's computer and a destination server on the internet. in general there are two main types of proxy servers: a forward proxy that handles requests from and to anywhere on the internet. a reverse proxy taking requests from the internet and forwarding them to servers in an internal network. learn more proxy servers an...

XInclude - MDN Web Docs Glossary: Definitions of Web-related terms
// fix: we test for file extensions as well in case file:// doesn't return content type (as seems to be the case); can some other tool be uesd in ff (or ie) to detect encoding of local file? probably just need bom test since other encodings must be specified var patternxml = /\.(svg|xml|xul|rdf|xhtml)$/; if...

Cacheable - MDN Web Docs Glossary: Definitions of Web-related terms
ple, firefox does not support it per https://bugzilla.mozilla.org/show_bug.cgi?id=109553.) other methods, like put or delete are not cacheable and their result cannot be cached. the status code of the response is known by the application caching, and it is considered cacheable. the following status code are cacheable: 200, 203, 204, 206, 300, 301, 404, 405, 410, 414, and 501. there are specific headers in the response, like cache-control, that prevents caching. note that some non-cacheable requests/responses to a specific uri may invalidate previously cached responses on the same uri. for example, a put to pagex.html will invalidate all cached get or head requests to the same uri. when both, the method of the request and the status of the response, are cacheable, the response to the request ...

CSS and JavaScript accessibility best practices - Learn web development
n, but don't get rid of it altogether — again, people rely on these clues to help them know what is going on. tables tables for presenting tabular data. you can see a good, simple example of table html and css in our table-css.html example (see it live also). table css generally serves to make the table fit better into your design and look less ugly. it is a good idea to make sure the table headers stand out (normally using bold), and use zebra striping to make different rows easier to parse. color and color contrast when choosing a color scheme for your website, make sure that the text (foreground) color contrasts well with the background color. your design might look cool, but it is no good if people with visual impairments like color blindness can't read your content. there is an easy...

HTML: A good basis for accessibility - Learn web development
screen reader user to associate rows or columns together as groupings of data. to do this, you need to know what the header rows are and if they are heading up rows, columns, etc. this can only be done visually for the above table (see bad-table.html and try the example out yourself). now have a look at our punk bands table example — you can see a few accessibility aids at work here: table headers are defined using <th> elements — you can also specify if they are headers for rows or columns using the scope attribute. this gives you complete groups of data that can be consumed by screen readers as single units. the <caption> element and <table> summary attribute both do similar jobs — they act as alt text for a table, giving a screen reader user a useful quick summary of the table's co...

HTML: A good basis for accessibility - Learn web development
screen reader user to associate rows or columns together as groupings of data. to do this, you need to know what the header rows are and if they are heading up rows, columns, etc. this can only be done visually for the above table (see bad-table.html and try the example out yourself). now have a look at our punk bands table example — you can see a few accessibility aids at work here: table headers are defined using <th> elements — you can also specify if they are headers for rows or columns using the scope attribute. this gives you complete groups of data that can be consumed by screen readers as single units. the <caption> element and <table> summary attribute both do similar jobs — they act as alt text for a table, giving a screen reader user a useful quick summary of the table's co...

Introduction to CSS layout - Learn web development
rder-radius: 5px; } .positioned { position: sticky; top: 30px; left: 30px; } note: to find more out about positioning, see our positioning article. table layout html tables are fine for displaying tabular data, but many years ago — before even basic css was supported reliably across browsers — web developers used to also use tables for entire web page layouts — putting their headers, footers, different columns, etc. in various table rows and columns. this worked at the time, but it has many problems — table layouts are inflexible, very heavy on markup, difficult to debug, and semantically wrong (e.g., screen reader users have problems navigating table layouts). the way that a table looks on a webpage when you use table markup is due to a set of css properties that define ...

Sending forms through JavaScript - Learn web development
this creates a formdata object that represents the data contained in the form. the html is typical: <form id="myform"> <label for="myname">send me your...

From object to iframe — other embedding technologies - Learn web development
andboxing altogether. note: sandboxing provides no protection if attackers can fool people into visiting malicious content directly (outside an iframe). if there's any chance that certain content may be malicious (e.g., user-generated content), please serve it from a different domain to your main site. configure csp directives csp stands for content security policy and provides a set of http headers (metadata sent along with your web pages when they are served from a web server) designed to improve the security of your html document. when it comes to securing <iframe>s, you can configure your server to send an appropriate x-frame-options header. this can prevent other websites from embedding your content in their web pages (which would enable clickjacking and a host of other attacks), which...

Graceful asynchronous programming with Promises - Learn web development
the results inside promise.all(), running a different function to display each one depending on what the type of code was. this would make it work for any number of items, not just three. also, you could determine what the type of file is being fetched without needing an explicit type property. you could, for example, check the content-type http header of the response in each case using response.headers.get("content-type"), and then react accordingly. running some final code after a promise fulfills/rejects there will be cases where you want to run a final block of code after a promise completes, regardless of whether it fulfilled or rejected. previously you'd have to include the same code in both the .then() and .catch() callbacks, for example: mypromise .then(response => { dosomething(re...

Properly configuring server MIME types - Learn web development
thor incorrectly reporting a mime type of a dangerous file as a safe type. this bypassed the normal download dialog resulting in internet explorer guessing that the content was an executable program and then running it on the user's computer. how to determine the mime type sent by a server in firefox, load the file and use tools | page info. you can also use rex swain's http viewer or live http headers to see the full headers and content of any file sent from a web server. according to the standards, a meta tag that gives the mime type such as <meta http-equiv="content-type" content="text/html"> should be ignored if there's a content-type line in the header. instead of looking for this line in the html source, use the above techniques to determine the mime type sent by the server. how to dete...

Command line crash course - Learn web development
. however, this url is the old location of the page. if you enter it in a new browser tab, you’ll (eventually) get redirected to /docs/web/api/windoworworkerglobalscope/fetch. therefore, if you use curl to request /docs/web/api/fetch, you won’t get an output. try it now: curl /docs/web/api/fetch we need to explicitly tell curl to follow redirects using the -l flag. let's also look at the headers that developer.mozilla.org returns using curl's -i flag, and print all the location redirects it sends to the terminal, by piping the output of curl into grep (we will ask grep to return all the lines that contain the word "location"). try running the following, and you’ll see that in fact there are three redirects happening before we reach the final page: curl /docs/web/api/fetch -l -i | gre...

Accessibility API cross-reference
>, <ul> <l> an item in a list listitem n/a list_item listitem <li> <li> may contain <lbl> (bullet, numeral, term etc.) and <lbody> a type of live region where new information is added in meaningful order and old information may disappear. log the main content of a document, distinct from complementary info, headers, footers, navigation, asides etc. main <main> a type of live region where non-essential information changes frequently. marquee the main menu bar below the app's title bar menubar menu_bar menu_bar menubar a menu item menuitem menu_item menu_item menuitem ...

Gecko info for Windows accessibility vendors
role_row not supported. see the section intentional differences with ie role_cell html: <td> dhtml: role="wairole:gr...

Multiprocess on Windows
a callback that allows us to do whatever we want with that request. our callback implementation forwards the method call to the main thread in order to invoke the method on the wrapped object. the interceptor is also aware that any outparams, which contain interfaces, must also be wrapped with interceptors of their own. this code lives in the mscom library, located in the tree at /ipc/mscom. its headers are exported to mozilla/mscom. ensuring that the interceptor supports your interfaces this information is current, but is likely to change when bug 1346957 is landed. interceptors cannot replicate interfaces without access to the metadata that describes those interfaces. since we are using com, we already generate metadata by declaring interfaces using midl. this does not (yet) work as trans...

Creating Sandboxed HTTP Connections
(listener, "http-on-examine-response", false); the final piece is to manipulate the cookies. in order to manipulate cookies, the nsichannel needs to be converted into a nsihttpchannel by using queryinterface (qi): var httpchannel = asubject.queryinterface(components.interfaces.nsihttpchannel); cookies are actually part of the http header, nsihttpchannel provides four methods for working with headers: two for getting and setting request headers, and two for getting and setting response headers. the cookie header for requests is called "cookie", while for responses it is "set-cookie". getrequestheader(aheader) - returns the request header value for the requested header. setrequestheader(aheader, avalue, amerge) - sets the request header's value. if amerge is true, the new value is appene...

Debugging update problems
that url might look something like: https://aus3.mozilla.org/update/3/firefox/12.0a1/20120106040225/darwin_x86_64-gcc3-u-i386-x86_64-shark/nightly-profiling/darwin%2010.8.0/default/default/update.xml?force=1 you can then request this url manually to see what's inside. ...

HTTP logging
lso makes logging less likely to interfere with race conditions, etc). however, if you are seeing your browser crash (or hang) you should add ",sync" to the list of logging modules in your moz_log environment variable. this will cause each log message to be immediately written (and fflush()'d), which is likely to give us more information about your crash. logging only http request and response headers there are two ways to do this: replace moz_log=nshttp:5 with moz_log=nshttp:3 in the commands above. there's a handy extension for firefox called http header live that you can use to capture just the http request and response headers. this is a useful tool when you want to peek at http traffic. turning off logging of socket-level transactions if you're not interested in socket-level log i...

Old Thunderbird build
es with less ram. good internet connection for the initial source download. build prerequisites depending on your operating system you will need to carry out a different process to prepare your machine. so firstly complete the instructions for your os and then continue following these build instructions. to build on windows, please read the prerequisites so you don't skip preparing the mapi headers needed to compile thunderbird. windows build prerequisites gnu/linux build prerequisites mac os x build prerequisites get the source note: on windows, you won't be able to build the thunderbird source code if it's under a directory with spaces in the path (e.g., don't use "documents and settings"). you can pick any other location, such as a new directory c:/thunderbird-src (where "c:/", ...

Simple Thunderbird build
h less ram. good internet connection for the initial source download. build prerequisites depending on your operating system you will need to carry out a different process to prepare your machine. so firstly complete the instructions for your os and then continue following these build instructions. windows build prerequisites gnu/linux build prerequisites macos build prerequisites mapi headers on windows: check that the mapi header files from https://www.microsoft.com/en-us/download/details.aspx?id=12905 are installed because the mapi header files (except mapi.h) are not bundled with visual studio 2017 (windows sdk 10). you should copy 17 of the 18 header files to a windows sdk include directory so that the build process will find the files, that is c:\program files (x86)\windows kits...

Storage access policy: Block cookies from trackers
ntified as trackers from accessing their cookies and other site storage when they are loaded in a third-party context. this prevents those resources from retrieving tracking identifiers stored in cookies or site storage and using them to identify users across visits to multiple first parties. specifically, firefox does this by imposing the following restrictions: cookies: block cookie request headers and ignore set-cookie response headers. return an empty string for calls to document.cookie and ignore requests to set cookies via document.cookie. dom storage: localstorage: window.localstorage: read and write attempts throw a securityerror exception. prior to firefox 70: window.localstorage is null. thus, attempts to read and write using this object will throw a typeerror exception. ses...

Embedding Tips
ch as onstatechange, onprogresschange etc. are called, allowing the embedder to know what is happening. when the operation is completed, the onstatechange will be notified by a combination of state_stop | state_is_network state flags. you may also use the progress listener to query the request supplied in onstatechange for more information. for example, if you wanted to check the server response headers, you might check onstatechange for state_start | state_is_request flags, and from the nsirequest argument qi fornsihttpchanne and call methods on that to determine response codes and other information from the server. it is left as an exercise to make this sample synchronous, i.e. wait for persistence to complete before returning. hint, add a native message processing loop after the call to save...

Mozilla Framework Based on Templates (MFBT)
it is fairly new, so its functionality is currently sparse. feel free to file bugs to add new functionality to it, or to move existing functionality into it, as needed. ...

Mozilla Web Services Security Model
take the following values: any means that the allow element applies to all services that use web-scripts-access.xml for security checks. there may be more such such services in the future than there are now. this is the same as not having a type attribute. load [not implemented!] ability to load documents via xmlhttprequest or similar mechanisms. soap soap requests without verification headers soapv soap requests with verification headers the from attribute the from attribute on the allow element says which calling sites the allow element applies to. if there is no from attribute then the allow element applies to all sites. the from attribute otherwise gives a url to match, which may contain up to two asterisks (*) that match any characters in the url. the match is done against a...

A guide to searching crash reports
at have been marked as relating to this signature. the numbers are large because this search matched all firefox crash reports from the past seven days. the first group has over 100,000 crash reports, which accounts for 7.77% of all matching crashes. this indicates there are over 1.3 million crash reports matching this search. you can reorder the groups in various ways by clicking on the column headers. the links within the results do the following things. the first link in each "signature" column cell links to a signature report, which contains additional details about crash reports with that signature. the "add term" link in each "signature" column cell lets you perform a narrower subsequent search among crash reports with that signature. the links in each "bugs" column cell link to bug ...

NSPR Contributor Guide
d with nspr 1.0.]. such is life. that said: there are some libraries that implement functions intended for use with applications using nspr, such as ...nsprpub/lib/libc/plgetopt.*. generally useful platform abstractions you agree to sustain, bug fix may rely on the nspr api may not rely on any other library api new platform ports all nspr api items must be implemented platform specific headers in pr/include/md/_platformname.[h!cfg] platform specific code in pr/src/md/platform/*.c make rules in config/_platform.mk documentation the files for nspr's documentation are maintained using a proprietary word processing system [don't ask]. document your work as described in [#newfeatures new features]. use the style of other nspr documentation. we will see that your documentation is transc...

Logging
these controls are platform dependent. logging is not compiled in for the win16 platform. logging is compiled into the nspr debug builds; logging is not compiled into the nspr optimized builds. the compile time #define values debug or force_pr_log enable nspr logging for application programs. to enable nspr logging and/or the debugging aids in your application, compile using the nspr debug build headers and runtime. set one of the compile-time defines when you build your application. execution-time control of nspr's logging uses two environment variables. these variables control which modules and levels are logged as well as the file name of the log file. by default, no logging is enabled at execution time. log types and variables two types supporting nspr logging are exposed in the api: p...

Function_Name
describe all side-effects on "out" parameters. ...

NSS_3.12.1_release_notes.html
bug 439123: assertion failure in libpkix at shutdown bug 440062: incorrect list element count in pkix_list_appenditem function bug 442618: elimin...

NSS 3.12.5 release_notes
mod_getdefaultmoddbflag in prlink.h nss_securememcmp port_loadlibraryfromorigin modified functions sgn_update (see cryptohi.h) the parameter "input" of this function is changed from unsigned char * to const unsigned char *. pk11_configurepkcs11 (see nss.h) the name of some parameters have been slightly changed ("des" became "desc"). deprecated headers the header file key.h is deprecated. please use keyhi.h instead. additional documentation in pk11pub.h: the caller of pk11_derencodepublickey should free the returned secitem with a secitem_freeitem(..., pr_true) call. pk11_readrawattribute allocates the buffer for returning the attribute value. the caller of pk11_readrawattribute should free the data buffer pointed to by item...

NSS 3.12.6 release notes
x_hash throws a null-argument exception on empty strings bug 530907: the peerid argument to ssl_setsockpeerid should be declared const bug 531188: decompression failure with https://livechat.merlin.pl/ bug 532417: build problem with spaces in path names bug 534943: clean up the makefiles in lib/ckfw/builtins bug 534945: lib/dev does not need to include headers from lib/ckfw bug 535669: move common makefile code in if and else to the outside bug 536023: der_utctimetotime and der_generalizedtimetotime ignore all bytes after an embedded null bug 536474: add support for logging pre-master secrets bug 537356: implement new safe ssl3 & tls renegotiation bug 537795: nss_initcontext does not work with nss_registersh...

NSS_3.12_release_notes.html
bug 132485: built-in root certs slot description is empty bug 177184: nss_cmsdecoder_cancel might have a leak bug 232392: erroneous root ca tests in nss libraries bug 286642: util should be in a shared library bug 287052: function to get crl entry reason code has incorrect prototype and implementation bug 299308: need a...

NSS Sample Code Sample_1_Hashing
nss sample code 1: hashing a file. this is an example program that demonstrates how to compute the hash of a file and save it to another file. this program illustrates the use of nss message apis. sample code 1 /* nspr headers */ #include <prprf.h> #include <prtypes.h> #include <plgetopt.h> #include <prio.h> /* nss headers */ #include <secoid.h> #include <secmodt.h> #include <sechash.h> typedef struct { const char *hashname; secoidtag oid; } nametagpair; /* the hash algorithms supported */ static const nametagpair hash_names[] = { { "md2", sec_oid_md2 }, { "md5", sec_oid_md5 }, { "sha1", sec_oid_sha1 }, { "sha256", sec_oid_sha256 }, { "sha384", sec_oid_sha384 }, { "sha512", sec_oid_sha512 } }; /* * maps a hash name to a secoidtag. * returns null i...

NSS Sample Code Utilities_1
ii) { /* first convert ascii to binary */ secitem filedata; char *asc, *body; /* read in ascii data */ rv = filetoitem(&filedata, infile); asc = (char *)filedata.data; if (!asc) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(asc, "-----begin")) != null) { char *trailer = null; asc = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(asc, '\r'); /* maybe this is a mac file */ if (body) trailer = strstr(++body, "-----end"); if (trailer != nul...

Utilities for nss samples
ii) { /* first convert ascii to binary */ secitem filedata; char *asc, *body; /* read in ascii data */ rv = filetoitem(&filedata, infile); asc = (char *)filedata.data; if (!asc) { pr_fprintf(pr_stderr, "unable to read data from input file\n"); rv = secfailure; goto cleanup; } /* check for headers and trailers and remove them */ if ((body = strstr(asc, "-----begin")) != null) { char *trailer = null; asc = body; body = port_strchr(body, '\n'); if (!body) body = port_strchr(asc, '\r'); /* maybe this is a mac file */ if (body) trailer = strstr(++body, "-----end"); if (trailer != nul...

sample1
1. a program to compute the hash of a file and save it to another file. /* nspr headers */ #include <prprf.h> #include <prtypes.h> #include <plgetopt.h> #include <prio.h> #include <prprf.h> /* nss headers */ #include <secoid.h> #include <secmodt.h> #include <sechash.h> typedef struct { const char *hashname; secoidtag oid; } nametagpair; /* the hash algorithms supported */ static const nametagpair hash_names[] = { { "md2", sec_oid_md2 }, { "md5", sec_oid_md5 }, { "sha1", sec_oid_sha1 }, { "sha256", sec_oid_sha256 }, { "sha384", sec_oid_sha384 }, { "sha512", sec_oid_sha512 } }; /* maps a hash name to a secoidtag. * returns null if the name is not a supported algorithm */ static secoidtag hashnametooidtag(const char *hash...

Installation guide
the build system of nss originated from netscape's build system, which predated the "configure; make; make test; make install" sequence that we're familiar with now. our makefiles also have an "install" target, but it has a different meaning: our "install" means installing the headers, libraries, and programs in the appropriate directories under mozilla/dist. so right now you need to manually install the headers, libraries, and programs in the directories you want. if you install the libraries in a directory other than /usr/lib, you usually need to set the ld_library_path environment variable. you can avoid that by installing the libraries in a directory that is $origin/../lib, where $origin is the directory where the programs are installed. this is done here: http://lxr.mozilla.org/secu...

NSS tools : cmsutil
directory (default is ".") -e envfile specify a file containing an enveloped message for a set of recipients to which you would like to send an encrypted message. if this is the first encrypted message for that set of recipients, a new enveloped message will be created that you can then use for future messages (encrypt only). -g include a signing time attribute (sign only). -h num generate email headers with info about cms message (decode only). -i infile use infile as a source of data (default is stdin). -n nickname specify nickname of certificate to sign with (sign only). -n suppress output of contents (decode only). -o outfile use outfile as a destination of data (default is stdout). -p include an s/mime capabilities attribute. -p password use password as key database password. -r recipient1,...

sslerr.html
base. sec_error_message_send_aborted -8103 message not sent. sec_error_inadequate_key_usage -8102 certificate key usage inadequate for attempted operation. sec_error_inadequate_cert_type -8101 certificate type not approved for application. sec_error_cert_addr_mismatch -8100 address in signing certificate does not match address in message headers. sec_error_pkcs12_unable_to_import_key -8099 unable to import. error attempting to import private key. sec_error_pkcs12_importing_cert_chain -8098 unable to import. error attempting to import certificate chain. sec_error_pkcs12_unable_to_locate_object_by_name -8097 unable to export. unable to locate certificate or key by nickname. sec_error_pk...

NSS Tools cmsutil
tory (default is ".") -e envfile specify a file containing an enveloped message for a set of recipients to which you would like to send an encrypted message. if this is the first encrypted message for that set of recipients, a new enveloped message will be created that you can then use for future messages (encrypt only). -g include a signing time attribute (sign only). -h num generate email headers with info about cms message (decode only). -i infile use infile as a source of data (default is stdin). -n nickname specify nickname of certificate to sign with (sign only). -n suppress output of contents (decode only). -o outfile use outfile as a destination of data (default is stdout). -p include an s/mime capabilities attribute. -p password use password as key database passwo...

NSS tools : cmsutil
d message for a set of recipients to which you would like to send an encrypted message. if this is the first encrypted message for that set of recipients, a new enveloped message will be created that you can then use for future messages (encrypt only). -g include a signing time attribute (sign only). -h num generate email headers with info about cms message (decode only). -i infile use infile as a source of data (default is stdin). -n nickname specify nickname of certificate to sign with (sign only). -n suppress output of contents (decode only). -o outfile use outfile as a destination of data (default is stdout). -p include an s/mime capabilit...

Installing Pork
our recent work has gotten mozilla to compile with gcc 4.2. ...

SpiderMonkey 1.8.8
built-in types, or of types which are now standardized, have been removed. these and other changes are explained in detail below. new javascript language features javascript 1.8.8 includes significant updates to language features, yo. typedef changes many types have been removed from the jsapi and replaced with simpler alternatives. including jsapi.h provides all these types, but more-specific headers also provide these types if you wish to use them in other code. obsolete typedef replacement type provided by uint8, int8, uint16, int16, uint32, int32, uint64, int64 uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t mozilla/stdint.h uintn, intn unsigned (also known as unsigned int), int n/a jsdoubl...

SpiderMonkey 17
of built-in types, or of types which are now standardized, have been removed. these and other changes are explained in detail below. new javascript language features javascript 17 includes significant updates to language features, yo. typedef changes many types have been removed from the jsapi and replaced with simpler alternatives. including jsapi.h provides all these types, but more-specific headers also provide these types if you wish to use them in other code. obsolete typedef replacement type provided by uint8, int8, uint16, int16, uint32, int32, uint64, int64 uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t mozilla/stdint.h uintn, intn unsigned (also known as unsigned int), int n/a jsdoubl...

Gecko Roles
frequently used features. role_statusbar represents a status bar, which is an area at the bottom of a window that displays information about the current operation, state of the application, or selected object. the status bar has multiple fields, which display different kinds of information. role_table represents a table that contains rows and columns of cells, and optionally, row headers and column headers. role_columnheader represents a column header, providing a visual label for a column in a table. role_rowheader represents a row header, which provides a visual label for a table row. role_column represents a column of cells within a table. role_row represents a row of cells within a table. role_cell represents a cell within a table. ...

Creating the Component Code
s and constants let's take a look at the first several lines of code in the component and discuss what they mean in xpcom. the includes and definitions at the top of an xpcom source file can give you an idea about some of the data types and techniques we'll be discussing more in the upcoming chapters. for example, mozilla_strict_api is a variable that shields you from certain private, non-xpcom headers. for example, including nsicomponentmanager.idl without mozilla_strict_api defined will include the following headers, which are not supported across versions (unfrozen): nscomponentmanagerutils.h nscomponentmanagerobsolete.h these variables are picked up by files that do not specify themselves as mozilla_strict_api. includes and constants in weblock1.cpp #include <stdio.h> // may be def...

Using XPCOM Utilities to Make Things Easier
don't need to do something like this: ns_impl_isupports2(classname, interface1, nsisupports) take a close look at the above example. note that it uses the actual name of the interface and not an iid. inside the macro, the interface name expands to ns_get_iid(), which is another macro that extracts the iid from the generated header of the interface. when an interface is written in xpidl, the headers include static declarations of their iids. on any interface that is generated by xpidl, you can call ns_get_iid() to obtain the iid which is associated with that interface. // returns a reference to a shared nsiid object\ static const nsiid iid1 = ns_get_iid(nsisupports); // constructs a new nsiid object static const nsiid iid2 = ns_isupports_iid; in order to use ns_impl_isupportsn, you must ...

XPCOM Stream Guide
m the underlying stream. nsbinaryinputstream @mozilla.org/binaryinputstream;1 nsiobjectinputstream (inherits from nsibinaryinputstream) converter convert unicode characters from an underlying stream. nsconverterinputstream @mozilla.org/intl/converter-input-stream;1 nsiconverterinputstream .init(stream, charset, buffersize, replacechar) mime separate headers from data. nsmimeinputstream @mozilla.org/network/mime-input-stream;1 nsimimeinputstream .setdata(stream) similarly, there are complex output streams which build from primitive output streams: complex output stream types type purpose native class contract id interface how to bind to a primitive output stream buffered store data in a buf...

How to build a binary XPCOM component using Visual Studio
add your own functionality. to make the project, you start with a standard multi-thread dll project. then make the following tweaks: add "..\gecko-sdk\include" to additional include directories add "..\gecko-sdk\lib" to additional library directories add "nspr4.lib xpcom.lib xpcomglue_s.lib" to additional dependencies add "xp_win;xp_win32″ to preprocessor definitions turn off precompiled headers (just to keep it simple) use a custom build step for the xpcom idl file (spawns xpidl-build.bat to process the idl with mozilla toolset, not midl) vc++ express project: xpcom-test.zip note: the project uses xpcom_glue. it also uses frozen linkage (dependent on xpcom). i am not defining xpcom_glue and i am linking against xpcomglue_s.lib create an xpcom component a full tutorial of xpcom is b...

Monitoring HTTP activity
rver.observeactivity() method is activity_type_socket_transport, the activity subtype, which indicates the specific type of activity that occurred, will be a socket transport status code. observable http activities when the activity type is activity_type_http_transaction, the activity subtype will be one of the activity subtype constants. these include the ability to monitor outgoing http request headers and bodies as well as incoming http headers and complete http transactions. ...

nsIAccessibleRole
". role_statusbar 23 represents a status bar, which is an area at the bottom of a window that displays information about the current operation, state of the application, or selected object. the status bar has multiple fields, which display different kinds of information. it is used for xul:statusbar. role_table 24 represents a table that contains rows and columns of cells, and optionally, row headers and column headers. it is used for html:table, role="grid". also refer to the following roles: role_columnheader, role_rowheader, role_column, role_row, role_cell. role_columnheader 25 represents a column header, providing a visual label for a column in a table. it is used for xul tree column headers, html:th, role="colheader". also refer to role_table. role_rowheader 26 represents a row head...

nsIChannel
eters for that request may be set by using the channel attributes, or by calling queryinterface() to retrieve a subclass of nsichannel for protocol-specific parameters. then, the uri can be fetched by calling open() or asyncopen(). after a request has been completed, the channel is still valid for accessing protocol-specific results. for example, queryinterfacing to nsihttpchannel allows response headers to be retrieved for the corresponding http transaction. this interface must be used only from the xpcom main thread. implemented by netwerk/base/src/nsbasechannel.cpp and netwerk/protocol/http/src/nshttpchannel.cpp. method overview void asyncopen(in nsistreamlistener alistener, in nsisupports acontext); nsiinputstream open(); attributes attribute type ...

nsICookieConsent
decision on what should be done with a cookie, based on a site's p3p policy and the user's preferences. the policy for the given uri and channel is also returned. nscookiestatus getconsent( in nsiuri uri, in nsihttpchannel httpchannel, in boolean isforeign, out nscookiepolicy policy ); parameters uri the uri to find the policy for. httpchannel the channel to extract the p3p headers from. isforeign true if the cookie originates from a third-party site. this is used to decide the cookie status based on user preferences. policy the policy for the given uri, or nsicookie::policy_unknown if one cannot be found. valid values are defined in nsicookie.idl. return value returns nscookiestatus. valid values are defined in nsicookie.idl. see also nsicookie ...

nsIDOMProgressEvent
nsigned long long loadedarg, in unsigned long long totalarg); deprecated since gecko 22.0 attributes attribute type description lengthcomputable boolean specifies whether or not the total size of the transfer is known. read only. loaded unsigned long long the number of bytes transferred since the beginning of the operation. this doesn't include headers and other overhead, but only the content itself. read only. total unsigned long long the total number of bytes of content that will be transferred during the operation. if the total size is unknown, this value is zero. read only. methods initprogressevent() deprecated since gecko 22.0 this method has been removed from use in javascript in gecko 22.0. use the regular const...

nsIFeedResult
ce, in astring aprefix); attributes attribute type description bozo boolean the feed processor sets the bozo bit when a feed triggers a fatal error during xml parsing. there may still be feed metadata and entries that were parsed before the error occurred. doc nsifeedcontainer the parsed feed or entry. null if a non-feed was processed. headers nsiproperties the http response headers that accompanied the feed. stylesheet nsiuri an xslt stylesheet available to transform the source of the feed. some feeds include this information in a processing instruction. it's generally intended for use by clients designed to work with specific feeds. uri nsiuri the address from which the feed was fetched. v...

nsIHTTPHeaderListener
inherits from: nsisupports last changed in gecko 1.9 (firefox 3) note: the plugin author must provide an instance to {geturl,posturl}() that implements both nsipluginstreamlistener and nsihttpheaderlistener. this instance is passed in through {geturl,posturl}()'s streamlistener parameter. the browser will then qi this streamlistener to see if it implements nsihttpheaderlistener. ...

nsIHttpActivityObserver
nts activity type constants constant value description activity_type_socket_transport 0x0001 socket transport activity has occurred. activity_type_http_transaction 0x0002 http transport activity has occurred. activity subtype constants constant value description activity_subtype_request_header 0x5001 the http request is about to be queued for sending. observers can look at request headers in aextrastringdata activity_subtype_request_body_sent 0x5002 the http request's body has been sent. activity_subtype_response_start 0x5003 the http response has started to arrive. activity_subtype_response_header 0x5004 the http response header has arrived. activity_subtype_response_complete 0x5005 the complete http response has been received. activity_subtype_transaction_close 0x5006 ...

nsIHttpChannelInternal
ailable() is delivered. void httpupgrade( in acstring aprotocolname, in nsihttpupgradelistener alistener ); parameters aprotocolname the value of the http upgrade request header. alistener the callback object used to handle a successful upgrade. setcookie() helper method to set a cookie with a consumer-provided cookie header, but using the channel's other information (uri's, prompters, date headers and so on.). void setcookie( in string acookieheader ); parameters acookieheader the cookie header to be parsed. setupfallbackchannel() sets up this channel as an application cache fallback channel. void setupfallbackchannel( in string afallbackkey ); parameters afallbackkey the fallback key. see also nsihttpchannel nsichannel nsihttpupgradelistener ...

nsIMIMEInputStream
it also allows automatic creation of the content-length header. inherits from: nsiinputstream last changed in gecko 1.3 implemented by: @mozilla.org/network/mime-input-stream;1. ...

nsIMsgCompFields
prbool indicates whether we need to check if the current documentcharset can represent all the characters in the message body. it should be initialized to true and set to false when 'send anyway' is selected by a user. ...

nsIMsgDatabase
if deleteviafolder is true, we'll call nsimsgfolder.deletemessages() to delete the messages. otherwise, we'll just delete them from the db. void applyretentionsettings(in nsimsgretentionsettings amsgretentionsettings, in boolean adeleteviafolder); hasnew() boolean hasnew(); clearnewlist() void clearnewlist(in boolean notify); addtonewlist() void ...

nsIMsgFilter
alue value, out boolean booleanand, out acstring arbitraryheader ) appendterm() void nsimsgfilter::appendterm (in nsimsgsearchterm term) createterm() nsimsgsearchterm nsimsgfilter::createterm ( ) matchhdr() void nsimsgfilter::matchhdr ( in nsimsgdbhdr msghdr, in nsimsgfolder folder, in nsimsgdatabase db, in string headers, in unsigned long headersize, out boolean result ) logrulehit() void nsimsgfilter::logrulehit ( in nsimsgruleaction afilteraction, in nsimsgdbhdr aheader ) createaction() nsimsgruleaction nsimsgfilter::createaction ( ) getactionat() nsimsgruleaction nsimsgfilter::getactionat (in long aindex) appendaction() void nsimsgfilter::appendaction (in nsimsgrul...

nsIMsgSearchTerm
smsgsearchattribvalue attrib; op attribute nsmsgsearchopvalue op; value attribute nsimsgsearchvalue value; booleanand attribute boolean booleanand; arbitraryheader attribute acstring arbitraryheader; hdrproperty /** * not to be confused with arbitraryheader, which is a header in the * rfc822 message. this is a property of the nsimsgdbhdr, and may have * nothing to do the message headers, e.g., gloda-id. * value.str will be compared with nsimsghdr::getproperty(hdrproperty). */ attribute acstring hdrproperty; customid /// identifier for a custom id used for this term, if any. attribute acstring customid; beginsgrouping attribute boolean beginsgrouping; endsgrouping attribute boolean endsgrouping; methods matchrfc822string boolean matchrfc822string(in string astring, ...

nsIMsgWindow
void closewindow(); attributes attribute type description windowcommands nsimsgwindowcommands this allows the backend code to send commands to the ui, such as clearmsgpane. statusfeedback nsimsgstatusfeedback this allows the backend code to send status feedback to the ui. msgheadersink nsimsgheadersink this allows the backend code to send message header information to the ui. transactionmanager nsitransactionmanager this is used to track undo/redo transactions. openfolder nsimsgfolder this is used to track the folder currently open in the ui. rootdocshell nsidocshell this is used ...

nsINavHistoryResultObserver
e of the node. nodeurichanged() called right after the uri of a node has changed. void nodeurichanged( in nsinavhistoryresultnode anode, in autf8string anewuri ); parameters anode the node whose uri has changed. anewuri the node's new uri. sortingchanged() this is called to indicate to the ui that the sort has changed to the given mode. for trees, for example, this would update the column headers to reflect the sorting. for many other types of views, this will not be applicable. void sortingchanged( in unsigned short sortingmode ); parameters sortingmode one of the nsinavhistoryqueryoptions.sorting methods, indicating the new sorting mode. ...

nsINavHistoryResultViewer
sert the item. anode the node to insert into the container; it may be either a leaf or another container. anewindex the index at which to insert the item. remarks the item previously at the specified index (if any) as well as everything below it, is shifted down by one. sortingchanged() called when the sorting order is changed to a particular mode. for trees, this would update the column headers to reflect the altered sorting. void sortingchanged( in unsigned short sortingmode ); parameters sortingmode one of the nsinavhistoryqueryoptions.sort_by_* constants, indicating the softing mode. remarks this method is only called to update the sorting user interface. invalidateall() is called as well if the sorting changes, in order to cause the contents to update properly. see a...

nsIRequest
ssion 1 << 13 disables validation of expired content, provided it has already been validated (at least once) since the start of this session. constant value description load_anonymous 1 << 14 when set, this flag indicates that no user-specific data should be added to the request when opened. this means that things like authorization tokens or cookie headers should not be added. note: this will prevent proxy authentications from working, so use this flag with caution. methods cancel() cancels the current request. this will close any open input or output streams and terminate any async requests. users should normally pass ns_binding_aborted, although other errors may also be passed. the error passed in will become the value of the s...

nsIScriptError
hrome registration" "xbl" "xbl prototype handler" "xbl content sink" "xbl javascript" "frameconstructor" categories the web console displays "hudconsole" "css parser" "css loader" "content javascript" "dom events" "dom:html" "dom window" "svg" "imagemap" "html" "canvas" "dom3 load" "dom" "malformed-xml" "dom worker javascript" "mixed content blocker" "csp" "invalid hsts headers" "insecure password field" see also using the web console error console nsiconsolemessage nsiscripterror2 ...

nsMsgSearchAttrib
/** otherheader must always be last attribute since * we can have an arbitrary # of these. the number can be changed, * however, because we never persist attribvalues as integers. */ const nsmsgsearchattribvalue otherheader = 52; // must be last attribute const nsmsgsearchattribvalue knummsgsearchattributes = 100; ...

nsMsgSearchScope
const nsmsgsearchscopevalue news = 5; const nsmsgsearchscopevalue newsex = 6; const nsmsgsearchscopevalue ldap = 7; const nsmsgsearchscopevalue localab = 8; const nsmsgsearchscopevalue allsearchablegroups = 9; const nsmsgsearchscopevalue newsfilter = 10; const nsmsgsearchscopevalue localaband = 11; const nsmsgsearchscopevalue ldapand = 12; // imap and news, searched using local headers const nsmsgsearchscopevalue onlinemanual = 13; /// local news + junk const nsmsgsearchscopevalue localnewsjunk = 14; /// local news + body const nsmsgsearchscopevalue localnewsbody = 15; /// local news + junk + body const nsmsgsearchscopevalue localnewsjunkbody = 16; }; ...

XPCOM Interface Reference
amnsimacdocksupportnsimarkupdocumentviewernsimemorynsimemorymultireporternsimemorymultireportercallbacknsimemoryreporternsimemoryreportermanagernsimenuboxobjectnsimessagebroadcasternsimessagelistenernsimessagelistenermanagernsimessagesendernsimessagewakeupservicensimessengernsimicrosummarynsimicrosummarygeneratornsimicrosummaryobservernsimicrosummaryservicensimicrosummarysetnsimimeconverternsimimeheadersnsimodulensimsgaccountnsimsgaccountmanagerextensionnsimsgcompfieldsnsimsgcustomcolumnhandlernsimsgdbhdrnsimsgdbviewnsimsgdbviewcommandupdaternsimsgdatabasensimsgfilternsimsgfiltercustomactionnsimsgfilterlistnsimsgfoldernsimsgheaderparsernsimsgidentitynsimsgincomingservernsimsgmessageservicensimsgprotocolinfonsimsgruleactionnsimsgsearchcustomtermnsimsgsearchnotifynsimsgsearchscopetermnsimsgsearchse...

Using the Gecko SDK
s therefore compiler sensitive. (<tt>about:buildconfig</tt> can be loaded in mozilla to reveal details about the compiler that was used.) for the remainder of this guide, we'll assume you are developing components under linux. (ports of this guide are welcome.) a "frozen" interface or function is guaranteed to be supported by future versions of same major version of the platform. the sdk contains headers for all of the frozen interfaces and functions, and it also contains headers for classes and functions defined in the glue libraries. when those classes or functions are used, the component must link with the corresponding static library. every frozen interface or function will be labeled as such in the idl or header file with "@status frozen". (note: nspr is the one exception to this rule. all n...

Xptcall Porting Guide
overview xptcall is a library that supports both invoking methods on arbitrary xpcom objects and implementing classes whose objects can impersonate any xpcom interface. it does this using platform specific assembly language code. this code needs to be ported to all platforms that want to support xptcall (and thus mozilla). ...

XPCOM
ck as the transactions take place.nscomptr versus refptrgecko code uses both nscomptr and refptr as smart pointers. this guide provides some explanation and advice on how to choose between them.observer notificationsthe following are topics that you can observe during the course of an application. unless otherwise noted you register for the topics using the nsiobserverservice.setting http request headershttp is one of the core technologies behind the web. in addition to the actual content, some important information is passed with http headers for both http requests and responses.storagestorage is a sqlite database api. it is available to trusted callers, meaning extensions and firefox components only.the thread managerthe thread manager, introduced in firefox 3, offers an easy to use mechanism f...

xpidl
gh xpconnect note: starting in gecko 9.0, xpidl has been replaced with pyxpidl in the gecko sdk. pyxpidl has been used for some time now, but now this older tool has been fully retired. xpidl is based on the libidl idl compiler from the gnome project. the libidl compiler depends on glib, also from the gnome project. the xpidl compiler is now part of the build process, allowing us to generate headers used by the xpcom components. please check the build documentation for further information on where to get libidl and glib. using xpidl to add an idl file to the build, use the xpidlsrcs makefile variable. for testing purposes, or one-off interface compilation, xpidl can be run from the command line: usage: ./xpidl -m mode [-w] [-v] [-t version number] [-d filename.pp] [-i path] [-o ...

XPIDL
must clean up the old data if it chooses to replace it. buffers must be deallocated with ns_free, and interface pointers must be release'd. afterwards, the above rules for out apply. shared out-parameters should not be freed, as they are intended to refer to constant string literals. resources (mostly outdated) some unsorted notes including a keyword list xpidl is a tool for generating c++ headers, java interfaces, xpconnect typelibs, and html documentation from xpidl files generating xpt files on windows a google groups post with instructions on how to use variable-length argument lists using xpidl. ...

MailNews fakeserver
properties: flags, keys (array of keys), nextkey (next key to use for new articles) getgroupstats group name array of [size, min, max] the size is an estimate if nntp_real_length is not specified in the daemon flags. getarticle message id newsarticle object pretty self-explanatory newsarticle api name arguments returns notes [constructor] text (as a string) n/a initializes all fields headers (property) map of header (lower-case) -> value body (property) text of body messageid (property) message id fulltext (property) full text as message without modification except added headers. ...

MailNews Filters
he case of pop3, filter execution is synchronous. for each new header, we evaluate the filter criteria and apply the actions synchronously, including moving a message to an other local folder, and advance to the next header. for imap, we tend to initiate the urls synchronously, but because we don't run two urls simultaneously on the same folder, the urls don't run until we've finished downloading headers. we also coalesce moves to the same destination folder, so that we can do them in one url/command to the server, and we playback those moves when the header download is done. after the fact filters these are one or more filters run on one or more folders *after* the headers have been downloaded. these filters are initiated in the filter editor, and implemented in nsmsgfilterservice.cpp. this ...

Spam filtering
in a binary format, in a file named "training.dat". initially, the training.dat file is empty (there was discussion of shipping with a default file). on spam detection, the user can choose to move spam to a special "junk" folder. the user can configure junk mail can be automatically purged from the "junk" folder. to analyze a message for spam, we need the entire message, not just the headers. spam detection happens after filters are run. white listing happens after filters, but before spam detection. the purge code is implemented as a search of the "junk" folder, looking for "old" message that have the proper junk status. when does purging happens? elaborate on the mime changes that were made for spam. currently, spam filtering is does not work for news, but it woul...

Create Custom Column
the article "creating a custom column" will get you well on the road to creating your own columns and populating them with custom data. the customdbheaders preference article provides information on a preference setting that exposes custom header data for use in a custom column within thunderbird's main view. ...

Filter Incoming Mail
er;1"] .getservice(components.interfaces.nsimimeconverter); var subject = mimeconvert.decodemimeheader(amsghdr.subject, null, false, true); // here with have a string to modify with javascript. ...

Folders and message lists
urns the first currently-selected message. when using this, be sure that there's only one selected message (or that you only care about the first one). otherwise, use one of the methods described below. gfolderdisplay.selectedmessages: returns an array of nsimsgdbhdrs for the selected messages. if a collapsed thread is in there and working with collapsed threads is enabled, this will include the headers for the messages in that collapsed thread. gfolderdisplay.selectedmessageuris: returns an array of the uris corresponding to the selected messages. like selectedmessages, this also includes messages in selected collapsed threads when so enabled. changing the current message selection in addition to getting the currently-selected messages, you can also change the selection: gfolderdisplay.s...

Constants - Plugins
t_scripting 13 plug-in is scriptable using xpconnect. npvers_has_npruntime_scripting 14 plug-in is scriptable using npruntime. npvers_has_form_values 15 nppvformvalue nppvariables are supported. npvers_has_popups_enabled_state 16 the npn_pushpopupsenabledstate() and npn_poppopupsenabledstate() functions are supported. npvers_has_response_headers 17 npstreams have response headers for http streams. npvers_has_npobject_enum 18 the npclass in question has an enumerate field, which lets you enumerate the properties of an npobject of that class. « previous ...

JSON viewer - Firefox Developer Tools
...

Rich output - Firefox Developer Tools
on your keyboard to navigate through objects displayed in the console. the right-arrow key opens the details of an object and the left-arrow key closes open objects. examining request details similar to examining object details, you can see the details about a network request directly in the console. click on the arrow next to the request and a details panel will open that is equivalent to the headers panel in the network monitor tool. export output to the clipboard once you have output in the console window, you can save it to the clipboard by right-clicking on the output and selecting export visible messages to clipboard: this will copy all of the output to the clipboard. then you can paste it into a document. the output will look something like this: console.log(todolist) array(4) [...

Using the CSS Painting API - Web APIs
ighcolour: hsla(155, 90%, 60%, 0.7); } h3 { --highcolour: hsla(255, 90%, 60%, 0.5); } h6 { --highcolour: hsla(355, 90%, 60%, 0.3); } and we register our worklet css.paintworklet.addmodule('https://mdn.github.io/houdini-examples/csspaint/intro/03partthree/header-highlight.js'); while you can't edit the worklet itself, you can play around with the css and html. maybe try float and clear on the headers? you could try making the background images above without the css paint api. it is doable, but you would have to declare a different, fairly complex linear gradient for each different color you wanted to create. with the css paint api, one worklet can be re-used, with different colors passed in this case. passing parameters with the css paint api, we not only have access to custom properties ...

Cache.keys() - Web APIs
syntax cache.keys(request, {options}).then(function(keys) { // do something with your array of requests }); parameters request optional the request want to return, if a specific key is desired. this can be a request object or a url. ...

Cache.match() - Web APIs
l be handled by the browser as if there were no service worker involvement. if fetch() returns a valid http response with an response code in the 4xx or 5xx range, the catch() will not be called. self.addeventlistener('fetch', function(event) { // we only want to call event.respondwith() if this is a get request for an html document. ...

Document.contentType - Web APIs
note: this property is unaffected by <meta> elements. syntax contenttype = document.contenttype; value contenttype is a read-only property. ...

DocumentOrShadowRoot.styleSheets - Web APIs
list of cssstylesheet objects, for stylesheets explicitly linked into or embedded in a document. examples function getstylesheet(unique_title) { for (var i=0; i<document.stylesheets.length; i++) { var sheet = document.stylesheets[i]; if (sheet.title == unique_title) { return sheet; } } } notes the returned list is ordered as follows: stylesheets retrieved from <link> headers are placed first, sorted in header order. stylesheets retrieved from the dom are placed after, sorted in tree order. specifications specification status comment shadow domthe definition of 'documentorshadowroot' in that specification. obsolete initial definition. ...

Introduction to the DOM - Web APIs
is to say, it's written in javascript, but it uses the dom to access the document and its elements. the dom is not a programming language, but without it, the javascript language wouldn't have any model or notion of web pages, html documents, xml documents, and their component parts (e.g. elements). every element in a document—the document as a whole, the head, tables within the document, table headers, text within the table cells—is part of the document object model for that document, so they can all be accessed and manipulated using the dom and a scripting language like javascript. in the beginning, javascript and the dom were tightly intertwined, but eventually, they evolved into separate entities. the page content is stored in the dom and may be accessed and manipulated via javascript, s...

GlobalEventHandlers.onerror - Web APIs
itself generates an error. notes when an error occurs in a script, loaded from a different origin, the details of the error are not reported to prevent leaking information (see bug 363897). instead the error reported is simply "script error." this behavior can be overriden in some browsers using the crossorigin attribute on <script> and having the server send the appropriate cors http response headers. a workaround is to isolate "script error." and handle it knowing that the error detail is only viewable in the browser console and not accessible via javascript. window.onerror = function (msg, url, lineno, columnno, error) { var string = msg.tolowercase(); var substring = "script error"; if (string.indexof(substring) > -1){ alert('script error: see browser console for detail'); } ...

HTMLTableSectionElement - Web APIs
the htmltablesectionelement interface provides special properties and methods (beyond the htmlelement interface it also has available to it by inheritance) for manipulating the layout and presentation of sections, that is headers, footers and bodies, in an html table. <div id="interfacediagram" style="display: inline-block; position: relative; width: 100%; padding-bottom: 20%; vertical-align: middle; overflow: hidden;"><svg style="display: inline-block; position: absolute; top: 0; left: 0;" viewbox="-50 0 600 120" preserveaspectratio="xminymin meet"><a xlink:href="/docs/web/api/eventtarget" target="_top"><rect x="1" y="1" width="110" height="50" fill="#fff" stroke="#d4dde4" stroke-width="2px" /><text x="56" y="30" font-size="12px" font-family="consolas,monaco,andale mono,monospace" fill="#...

The HTML DOM API - Web APIs
t: while the document interface is defined as part of the dom specification, the html specification significantly enhances it to add information specific to using the dom in the context of a web browser, as well as to using it to represent html documents specifically. among the things added to document by the html standard are: support for accessing various information provided by the http headers when loading the page, such as the location from which the document was loaded, cookies, modification date, referring site, and so forth. access to lists of elements in the document's <head> block and body, as well as lists of the images, links, scripts, etc. contained in the document. support for interacting with the user by examining focus and by executing commands on editable content. event...

MediaDevices.getUserMedia() - Web APIs
which will require the use of feature policy, and your code needs to be prepared to deal with this. for example, you may need to use the allow attribute on any <iframe> that uses getusermedia(), and pages that use getusermedia() will eventually need to supply the feature-policy header. the two permissions that apply to getusermedia() are camera and microphone. ...

NavigatorID.userAgent - Web APIs
pera 6+ allows users to set the browser identification string via a menu. microsoft internet explorer uses the windows registry. safari and icab allow users to change the browser user agent string to predefined internet explorer or netscape strings via a menu. syntax var ua = navigator.useragent; value a domstring specifying the complete user agent string the browser provides both in http headers and in response to this and other related methods on the navigator object. the user agent string is built on a formal structure which can be decomposed into several pieces of info. each of these pieces of info comes from other navigator properties which are also settable by the user. gecko-based browsers comply with the following general structure: useragent = appcodename/appversion number (pla...

performance.now() - Web APIs
200 // 8866700 // ... in firefox, you can also enable privacy.resistfingerprinting — this changes the precision to 100ms or the value of privacy.resistfingerprinting.reducetimerprecision.microseconds, whichever is larger. starting with firefox 79, high resolution timers can be used if you cross-origin isolate your document using the cross-origin-opener-policy and cross-origin-embedder-policy headers: cross-origin-opener-policy: same-origin cross-origin-embedder-policy: require-corp these headers ensure a top-level document does not share a browsing context group with cross-origin documents. coop process-isolates your document and potential attackers can't access to your global object if they were opening it in a popup, preventing a set of cross-origin attacks dubbed xs-leaks. specificati...

ProgressEvent() - Web APIs
is calculable. in other words, it tells if the progress is measurable or not. it defaults to false. loaded optional is an unsigned long long representing the amount of work already performed by the underlying process. the ratio of work done can be calculated with the property and progressevent.total. when downloading a resource using http, this only represent the part of the content itself, not headers and other overhead. it defaults to 0. total optional is an unsigned long long representing the total amount of work that the underlying process is in the progress of performing. when downloading a resource using http, this only represent the content itself, not headers and other overhead. it defaults to 0. specifications specification status comment xmlhttprequestthe ...

ProgressEvent.initProgressEvent() - Web APIs
one, by the underlying process is calculable. in other words, it tells if the progress is measurable or not. loaded is an unsigned long long representing the amount of work already performed by the underlying process. the ratio of work done can be calculated with the property and progressevent.total. when downloading a resource using http, this only represent the part of the content itself, not headers and other overhead. total is an unsigned long long representing the total amount of work that the underlying process is in the progress of performing. when downloading a resource using http, this only represent the content itself, not headers and other overhead. specifications this feature does not exist in any specifications. ...

ProgressEvent.loaded - Web APIs
the progressevent.loaded read-only property is an integer representing the amount of work already performed by the underlying process. the ratio of work done can be calculated with the property and progressevent.total. when downloading a resource using http, this only represent the part of the content itself, not headers and other overhead. syntax value = progressevent.loaded specifications specification status comment xmlhttprequestthe definition of 'progressevent.loaded' in that specification. living standard ...

ProgressEvent.total - Web APIs
the progressevent.total read-only property is an integer representing the total amount of work that the underlying process is in the progress of performing. when downloading a resource using http, this only represent the content itself, not headers and other overhead. syntax value = progressevent.total specifications specification status comment xmlhttprequestthe definition of 'progressevent.lengthcomputable' in that specification. living standard ...

ProgressEvent - Web APIs
ocess is calculable. in other words, it tells if the progress is measurable or not. progressevent.loaded read only is an unsigned long long representing the amount of work already performed by the underlying process. the ratio of work done can be calculated with the property and progressevent.total. when downloading a resource using http, this only represent the part of the content itself, not headers and other overhead. progressevent.total read only is an unsigned long long representing the total amount of work that the underlying process is in the progress of performing. when downloading a resource using http, this only represent the content itself, not headers and other overhead. methods also inherits methods from its parent event. progressevent.initprogressevent() initializ...

RTCIceCandidatePairStats.bytesReceived - Web APIs
the rtcicecandidatepairstats property bytesreceived indicates the total number of payload bytes—that is, bytes which aren't overhead such as headers or padding—that hve been received to date on the connection described by the candidate pair. the bytessent property reports the number of bytes sent so far on the described connection. syntax received = rtcicecandidatepairstats.bytesreceived; value an integer value indicating the total number of bytes received so far on the connection described by this candidate pair. only data bytes are counted; overhead such as padding, headers, and the like are not included in this count. specifications specification status comment identifiers for webrtc's statistics apithe definition of 'rtcicecandidatepairstats.bytesreceiv...

RTCIceCandidatePairStats.bytesSent - Web APIs
the rtcicecandidatepairstats property bytessent indicates the total number of payload bytes—that is, bytes which aren't overhead such as headers or padding—that hve been sent so far on the connection described by the candidate pair. the bytesreceived property reports the number of bytes received so far on the described connection. syntax sent = rtcicecandidatepairstats.bytessent; value an integer value indicating the total number of bytes sent so far on the connection described by this candidate pair. only data bytes are counted; overhead such as padding, headers, and the like are not included in this count. specifications specification status comment identifiers for webrtc's statistics apithe definition of 'rtcicecandidatepairstats.bytessent' in that speci...

RTCIceCandidatePairStats - Web APIs
ting the available outbound capacity of the network by reporting the total number of bits per second available for all of the candidate pair's outoing rtp streams. this does not take into account the size of the ip overhead, nor any other transport layers such as tcp or udp. bytesreceieved optional the total number of payload bytes received (that is, the total number of bytes received minus any headers, padding, or other administrative overhead) on this candidate pair so far. bytessent optional the total number of payload bytes sent (that is, the total number of bytes sent minus any headers, padding, or other administrative overhead) so far on this candidate pair. circuitbreakertriggercount optional an integer value indicating the number of times the circuit-breaker has been triggered for t...

ReadableStream - Web APIs
living standard initial definition ...

ReadableStreamDefaultReader - Web APIs
living standard initial definition ...

Request - Web APIs
tains the context of the request (e.g., audio, image, iframe, etc.) request.credentials read only contains the credentials of the request (e.g., omit, same-origin, include). the default is same-origin. request.destination read only returns a string from the requestdestination enum describing the request's destination. this is a string indicating the type of content being requested. request.headers read only contains the associated headers object of the request. request.integrity read only contains the subresource integrity value of the request (e.g., sha256-bpfbw7ivv8q2jlit13fxdyae2tjllusrsz273h2nfse=). request.method read only contains the request's method (get, post, etc.) request.mode read only contains the mode of the request (e.g., cors, no-cors, same-origin, navigate.) re...

Response() - Web APIs
blob buffersource formdata readablestream urlsearchparams usvstring init optional an options object containing any custom settings that you want to apply to the response, or an empty object (which is the default value). the possible options are: status: the status code for the reponse, e.g., 200. statustext: the status message associated with the status code, e.g., ok. headers: any headers you want to add to your response, contained within a headers object or object literal of bytestring key/value pairs (see http headers for a reference). examples in our fetch response example (see fetch response live) we create a new response object using the constructor, passing it a new blob as a body, and an init object containing a custom status and statustext: var myblob ...

Response.type - Web APIs
the type read-only property of the response interface contains the type of the response. it can be one of the following: basic: normal, same origin response, with all headers exposed except “set-cookie” and “set-cookie2″. cors: response was received from a valid cross-origin request. certain headers and the body may be accessed. error: network error. no useful information describing the error is available. the response’s status is 0, headers are empty and immutable. this is the type for a response obtained from response.error(). opaque: response for “no-cors” request to cross-origin resource. severely restricted. opaqueredirect: the fetch request was made with redirect: "manual". the response's status is 0, headers are empty, body is null and trailer is empty. note: an "e...

Using the Screen Capture API - Web APIs
capture" will present the user agent's interface for selecting a screen, window, or tab to share. security in order to function when feature policy is enabled, you will need the display-capture permission. this can be done using the feature-policy http header or—if you're using the screen capture api in an <iframe>, the <iframe> element's allow attribute. ...

ServiceWorkerGlobalScope: pushsubscriptionchange event - Web APIs
ired. examples this example, run in the context of a service worker, listens for a pushsubscriptionchange event and re-subscribes to the lapsed subscription. self.addeventlistener("pushsubscriptionchange", event => { event.waituntil(swregistration.pushmanager.subscribe(event.oldsubscription.options) .then(subscription => { return fetch("register", { method: "post", headers: { "content-type": "application/json" }, body: json.stringify({ endpoint: subscription.endpoint }) }); }) ); }, false); when a pushsubscriptionchange event arrives, indicating that the subscription has expired, we resubscribe by calling the push manager's subscribe() method. when the returned promise is resolved, we receive the new subscrip...

Storage Access API - Web APIs
storage access as well, without needing to call requeststorageaccess() separately. if an embedded page from tracker.example has previously successfully obtained storage access on top-level origin foo.example, all embedded subresources from tracker.example on foo.example (e.g. scripts, images, stylesheets, etc.) will load with access to their first-party storage, which means they may send cookie headers and honor incoming set-cookie headers. in firefox, when the promise returned from requeststorageaccess() is resolved, the embedded page will gain access to its entire first-party storage, not just cookies. this includes access to apis such as web storage, indexeddb, dom cache, and so on. in firefox, the storage access grants are phased out after 30 calendar days passing, whereas in safari the ...

Web Video Text Tracks Format (WebVTT) - Web APIs
of new vtt regions. tutorial on how to write a webvtt file there are few steps that can be followed to write a simple webvtt file. before start, it must be noted that you can make use of a notepad and then save the file as ‘.vtt’ file. steps are given below: open a notepad. the first line of webvtt is standardized similar to the way some other languages require you to put headers as the file starts to indicate the file type. on the very first line you have to write: webvtt 3. leave the second line blank, and on the third line the time for first cue is to be specified. for example, for a first cue starting at time 1 second and ending at 5 seconds, it is written as: 00:01.000 --> 00:05.000 on the next line you can write the caption for this cue which will run f...

window.postMessage() - Web APIs
use postmessage to send data to other windows. a malicious site can change the location of the window without your knowledge, and therefore it can intercept the data sent using postmessage. secure shared memory messaging if postmessage() throws when used with sharedarraybuffer objects, you might need to make sure you cross-site isolated your site properly. ...

WindowOrWorkerGlobalScope.crossOriginIsolated - Web APIs
the crossoriginisolated read-only property of the windoworworkerglobalscope interface returns a boolean value that indicates whether a sharedarraybuffer can be sent via a window.postmessage() call. this value is dependant on any cross-origin-opener-policy and cross-origin-embedder-policy headers present in the response. syntax var mycrossoriginisolated = self.crossoriginisolated; // or just crossoriginisolated value a boolean value examples if(crossoriginisolated) { // post sharedarraybuffer } else { // do something else } specifications specification status comment html living standardthe definition of 'crossoriginisolated' in that specification. living standard initial definition. ...

Sending and Receiving Binary Data - Web APIs
to gecko 9.0 (firefox 9.0 / thunderbird 9.0 / seamonkey 2.6). add information about other browsers' support here. submitting forms and uploading files please, read this paragraph. firefox-specific examples this example transmits binary content asynchronously, using the post method, and firefox's non-standard sendasbinary(). var req = new xmlhttprequest(); req.open("post", url, true); // set headers and mime-type appropriately req.setrequestheader("content-length", 741); req.sendasbinary(abody); line 4 sets the content-length header to 741, indicating that the data is 741 bytes long. obviously you need to change this value based on the actual size of the data being sent. line 5 uses the sendasbinary() method to initiate the request. note: this non-standard sendasbinary method is conside...

XMLHttpRequest.mozAnon - Web APIs
...

XMLHttpRequest.withCredentials - Web APIs
the xmlhttprequest.withcredentials property is a boolean that indicates whether or not cross-site access-control requests should be made using credentials such as cookies, authorization headers or tls client certificates. setting withcredentials has no effect on same-site requests. in addition, this flag is also used to indicate when cookies are to be ignored in the response. the default is false. xmlhttprequest from a different domain cannot set cookie values for their own domain unless withcredentials is set to true before making the request. the third-party cookies obtained by setting withcredentials to true will still honor same-origin policy and hence can not be accessed by the requesting script through document.cookie or from response headers. note: this never affects same-site requests...

XSL Transformations in Mozilla FAQ - Web APIs
e type for both source and stylesheet are set to an xml mimetype, namely text/xml or application/xml. the xslt namespace is http://www.w3.org/1999/xsl/transform. use the <?xml-stylesheet ?> processing instruction instead of the non-standard xml:stylesheet. the most common cause is the mime type handling. to find out which mime type your server sends, look at page info, use extensions like livehttpheaders or a download manager like wget. mozilla won't load xslt stylesheets from a different domain for security reasons. note: starting in gecko 7.0, both text/xsl and application/xslt+xml are supported mime types for xslt media stylesheets. note that firefox will override your xslt stylesheet if your xml is detected as an rss or atom feed. a known workaround is to add a sufficiently long xml comme...

Web APIs
ptelement htmlselectelement htmlshadowelement htmlslotelement htmlsourceelement htmlspanelement htmlstyleelement htmltablecaptionelement htmltablecellelement htmltablecolelement htmltableelement htmltablerowelement htmltablesectionelement htmltemplateelement htmltextareaelement htmltimeelement htmltitleelement htmltrackelement htmlulistelement htmlunknownelement htmlvideoelement hashchangeevent headers history hkdfparams hmacimportparams hmackeygenparams i idbcursor idbcursorsync idbcursorwithvalue idbdatabase idbdatabaseexception idbdatabasesync idbenvironment idbenvironmentsync idbfactory idbfactorysync idbindex idbindexsync idbkeyrange idblocaleawarekeyrange idbmutablefile idbobjectstore idbobjectstoresync idbopendbrequest idbrequest idbtransaction idbtransacti...

ARIA Screen Reader Implementors Guide - Accessibility
bly desirable to have at least a tiny timeout before presenting atomic region changes, in order to avoid presenting the region twice for two changes that occur quickly one after the other. include labels when presenting changes: if the change occurs in something with a semantic label of some kind, speak the label. this is particularly important for changes in data cells, where the column and row headers provide important contextual information. ideas for settings and heuristics allow for a different voice (in text-to-speech) or other varying presentational characteristics to set live changes apart. when no wai-aria markup is present, automatically present some changes unless the user configures all live changes to off. for example, automatically speak changes that are caused by the user's ow...

Using the presentation role - Accessibility
cribes the effect it has on browsers and assistive technology. the presentation role is used to remove semantic meaning from an element and any of its related child elements. for example, a table used for layout purposes could have the presentation role applied to the table element to remove any semantic meaning from the table element and any of its table related children elements, such as table headers and table data elements. non-table related elements should retain their semantic meaning, however. possible effects on user agents and assistive technology note: opinions may differ on how assistive technology should handle this technique. the information provided above is one of those opinions and therefore not normative. examples example 1: <ul role="tablist"> <li role="presentation"> ...

ARIA: cell role - Accessibility
a-rowindex, and aria-rowspan. using the native html table element (<table>) along with the table row element (<tr>) and table cell element (<td>) whenever possible is strongly encouraged. associated wai-aria roles, states, and properties context roles role="row" an element with role="row" is a row of cells within a tabular structure. a row contains one or more cells, grid cells, column headers, or row headers within a grid, table or treegrid, and optionally within a rowgroup. role="rowgroup" row is a required cell parent. rowgroup is an optional contextual row parent. it establishes a relationship between descendant rows. it is a structural equivalent to the thead, tfoot, and tbody elements in an html table element. role="table" one of the three possible contexts (along with grid a...

Accessibility documentation index - Accessibility
the listbox role is used for lists from which a user may select one or more items which are static and, unlike html <select> elements, may contain images. 69 aria: row role aria, aria role, aria row, aria row role, accessibility, reference, row role an element with role="row" is a row of cells within a tabular structure. a row contains one or more cells, grid cells or column headers, and possibly a row header, within a grid, table or treegrid, and optionally within a rowgroup. 70 aria: rowgroup role aria, html, rôles, rowgroup, table an element with role="rowgroup" is a group of rows within a tabular structure. a rowgroup contains one or more rows of cells, grid cells, column headers, or row headers within a grid, table or treegrid. 71 aria:...

:host() - CSS: Cascading Style Sheets
...

:host-context() - CSS: Cascading Style Sheets
t span = document.createelement('span'); span.textcontent = this.textcontent; const shadowroot = this.attachshadow({mode: 'open'}); shadowroot.appendchild(style); shadowroot.appendchild(span); style.textcontent = 'span:hover { text-decoration: underline; }' + ':host-context(h1) { font-style: italic; }' + ':host-context(h1):after { content: " - no links in headers!" }' + ':host-context(article, aside) { color: gray; }' + ':host(.footer) { color : red; }' + ':host { background: rgba(0,0,0,0.1); padding: 2px 5px; }'; the :host-context(h1) { font-style: italic; } and :host-context(h1):after { content: " - no links in headers!" } rules style the instance of the <context-span> element (the shadow host...

:host - CSS: Cascading Style Sheets
specifications...

:lang() - CSS: Cascading Style Sheets
the :lang() css pseudo-class matches elements based on the language they are determined to be in. /* selects any <p> in english (en) */ p:lang(en) { quotes: '\201c' '\201d' '\2018' '\2019'; } note: in html, the language is determined by a combination of the lang attribute, the <meta> element, and possibly by information from the protocol (such as http headers). for other document types there may be other document methods for determining the language. syntax formal syntax :lang( <language-code> ) parameter <language-code> a <string> representing the language you want to target. acceptable values are specified in the html spec. examples in this example, the :lang() pseudo-class is used to match the parents of quote elements (<q>) using child combinators. note that this doesn't ill...

Shapes From Images - CSS: Cascading Style Sheets
from the shape, giving a margin around the created shape and the text. cors compatibility something that you will run into when creating shapes from an image is that the image you use must be cors compatible. an image hosted on the same domain as your site should work, however if your images are hosted on a different domain such as on a cdn you should ensure that they are sending the correct headers to enable them to be used for shapes. due to this requirement for cors compatible images, if you are previewing your file locally without using a local web server, your shape will not work. is it a cors issue? devtools can help you to identify cors errors. in chrome the console will alert you to cors problems. in firefox if you inspect the property you will be alerted to the fact that the image...

Mozilla CSS extensions - CSS: Cascading Style Sheets
border-style and outline-style -...

appearance (-moz-appearance, -webkit-appearance) - CSS: Cascading Style Sheets
ox 64. toolbarbutton-dropdown firefox removed in firefox 64. toolbargripper firefox removed in firefox 64. toolbox firefox removed in firefox 64. tooltip firefox removed in firefox 64. treeheader firefox removed in firefox 64. treeheadercell firefox removed in firefox 64. treeheadersortarrow firefox removed in firefox 64. treeitem firefox removed in firefox 64. treeline firefox removed in firefox 64. treetwisty firefox removed in firefox 64. treetwistyopen firefox removed in firefox 64. treeview firefox removed in firefox 64. -moz-win-borderless-glass firef...

inherit - CSS: Cascading Style Sheets
to override another rule. for non-inherited properties, this specifies a behavior that typically makes relatively little sense and you may consider using initial instead, or unset on the all property. inheritance is always from the parent element in the document tree, even when the parent element is not the containing block. examples exclude selected elements from a rule /* make second-level headers green */ h2 { color: green; } /* ...but leave those in the sidebar alone so they use their parent's color */ #sidebar h2 { color: inherit; } in this example the h2 elements inside the sidebar might be different colors. for example, if one of them were the child of a div matched by the rule ... div#current { color: blue; } ... it would be blue. specifications specification stat...

revert - CSS: Cascading Style Sheets
>s to table, etc. examples revert vs unset although revert and unset are similar they differ for some properties for some elements. so in the below example, we set custom font-weight in a global stylesheet, but then try to unset and revert. unset will keep the text normal because this is an initial value for font-weight property. revert will revert to bold because this is a default value for headers in most browsers. h3 { font-weight: normal; color: blue; } <h3 style="font-weight: unset; color: unset;">this will still have font-weight: normal, but color: black</h3> <p>just some text</p> <h3 style="font-weight: revert; color: revert;">this should have its original font-weight (bold) and color: black</h3> <p>just some text</p> revert all reverting all values is useful when you did he...

text-orientation - CSS: Cascading Style Sheets
the source for this interactive example is stored in a github repository. if you'd like to contribute to the interactive examples project, please clone https://github.com/mdn/interactive-examples and send us a pull request. ...

Getting Started - Developer guides
" button; the event handler calls the makerequest() function; the request is made and then (onreadystatechange) the execution is passed to alertcontents(); alertcontents() checks if the response was received and ok, then alert()s the contents of the test.html file. note: if you're sending a request to a piece of code that will return xml, rather than a static html file, you must set response headers to work in internet explorer. if you do not set header content-type: application/xml, ie will throw a javascript "object expected" error after the line where you tried to access an xml element. note 2: if you do not set header cache-control: no-cache the browser will cache the response and never re-submit the request, making debugging challenging. you can also add an always-different get paramet...

Block formatting context - Developer guides
(elements with display: table-cell, which is the default for html table cells). table captions (elements with display: table-caption, which is the default for html table captions). anonymous table cells implicitly created by the elements with display: table, table-row, table-row-group, table-header-group, table-footer-group (which is the default for html tables, table rows, table bodies, table headers, and table footers, respectively), or inline-table. block elements where overflow has a value other than visible. display: flow-root. elements with contain: layout, content, or paint. flex items (direct children of the element with display: flex or inline-flex) if they are neither flex nor grid nor table containers themselves. grid items (direct children of the element with display: grid or ...

Using HTML sections and outlines - Developer guides
article> element indicates self-contained content, meaning that if you removed all the other html except the <article> element, the content would still make sense to a reader. <article> <h1>how to become an mdn contributor</h1> <p> do you want to help protect the web?.... </p> </article> nesting elements inside an article the <article> element can have other semantic elements such as headers, asides, and footers. this is often useful if you want to add css selectors to the class property of the element to style the document. <article> <header> <h1>how to become an mdn contributor</h1> </header> <p> do you want to help protect the web?.... </p> <aside> <blockquote> amazing quote from article </blockquote> </aside> <footer> <p> author info...

XHTML - Developer guides
xhtml is a term that was historically used to describe html documents written to conform with xml syntax rules. the following example shows an html document and corresponding "xhtml" document, and the accompanying http content-type headers they should be served with. html document content-type: text/html <!doctype html> <html lang=en> <head> <meta charset=utf-8> <title>html</title> </head> <body> <p>i am a html document</p> </body> </html> xhtml document content-type: application/xhtml+xml <?xml version="1.0" encoding="utf-8"?> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>xhtml</title> </head> <body> <p>i am a xhtml document</p> </body> </html> in practice, very few "xhtml" documents are served over the web with a co...

HTML attribute reference - HTML: Hypertext Markup Language
e of the button's form owner. formtarget <button>, <input> if the button/input is a submit button (type="submit"), this attribute specifies the browsing context (for example, tab, window, or inline frame) in which to display the response that is received after submitting the form. if this attribute is specified, it overrides the target attribute of the button's form owner. headers <td>, <th> ids of the <th> elements which applies to this element. height <canvas>, <embed>, <iframe>, <img>, <input>, <object>, <video> specifies the height of elements listed here. for all other elements, use the css height property. note: in some instances, such as <div>, this is a legacy attribute, in which case the css height property should be used instea...

Allowing cross-origin use of images and canvas - HTML: Hypertext Markup Language
b site itself. web server configuration the first thing we need is a server that's configured to host images with the access-control-allow-origin header configured to permit cross-origin access to image files. let's assume we're serving our site using apache. ...

<meta>: The Document-level Metadata element - HTML: Hypertext Markup Language
eclares the document's character encoding. if the attribute is present, its value must be an ascii case-insensitive match for the string "utf-8". content this attribute contains the value for the http-equiv or name attribute, depending on which is used. http-equiv defines a pragma directive. the attribute is named http-equiv(alent) because all the allowed values are names of particular http headers: content-security-policy allows page authors to define a content policy for the current page. content policies mostly specify allowed server origins and script endpoints which help guard against cross-site scripting attacks. content-type if specified, the content attribute must have the value "text/html; charset=utf-8". note: can only be used in documents served with a text/html...

<td>: The Table Data Cell element - HTML: Hypertext Markup Language
ement permitted aria roles any dom interface htmltabledatacellelement attributes this element includes the global attributes. colspan this attribute contains a non-negative integer value that indicates for how many columns the cell extends. its default value is 1. values higher than 1000 will be considered as incorrect and will be set to the default value (1). headers this attribute contains a list of space-separated strings, each corresponding to the id attribute of the <th> elements that apply to this element. rowspan this attribute contains a non-negative integer value that indicates for how many rows the cell extends. its default value is 1; if its value is set to 0, it extends until the end of the table section (<thead>, <tbody>, <tfoot>, even if impli...

HTML elements reference - HTML: Hypertext Markup Language
table (<table>). <td> the html <td> element defines a cell of a table that contains data. it participates in the table model. <tfoot> the html <tfoot> element defines a set of rows summarizing the columns of the table. <th> the html <th> element defines a cell as header of a group of table cells. the exact nature of this group is defined by the scope and headers attributes. <thead> the html <thead> element defines a set of rows defining the head of the columns of the table. <tr> the html <tr> element defines a row of cells in a table. the row's cells can then be established using a mix of <td> (data cell) and <th> (header cell) elements. forms html provides a number of elements which can be used together to create for...

HTML documentation index - HTML: Hypertext Markup Language
the html <tfoot> element defines a set of rows summarizing the columns of the table. 208 <th> element, html, html tabular data, heading cell, reference, table cell, table head, table header, table heading, table heading cell, tables, web, cell the html <th> element defines a cell as header of a group of table cells. the exact nature of this group is defined by the scope and headers attributes. 209 <thead>: the table head element element, html, html tabular data, reference, tables, web the html <thead> element defines a set of rows defining the head of the columns of the table. 210 <time> element, html, html text-level semantics, html5, html:flow content, html:palpable content, html:phrasing content, reference, web the html <time> el...

Preloading content with rel="preload" - HTML: Hypertext Markup Language
imported scripts, or web workers. larger images and video files. preload has other advantages too. using as to specify the type of content to be preloaded allows the browser to: prioritize resource loading more accurately. store in the cache for future requests, reusing the resource if appropriate. apply the correct content security policy to the resource. set the correct accept request headers for it. what types of content can be preloaded? many different content types can be preloaded. the possible as attribute values are: audio: audio file, as typically used in <audio>. document: an html document intended to be embedded by a <frame> or <iframe>. embed: a resource to be embedded inside an <embed> element. fetch: resource to be accessed by a fetch or xhr request, such as an ar...

Reason: CORS header 'Access-Control-Allow-Origin' missing - HTTP
ontrol-allow-origin: * warning: using the wildcard to allow all sites to access a private api is a bad idea. to allow any site to make cors requests without using the * wildcard (for example, to enable credentials), your server must read the value of the request's origin header and use that value to set access-control-allow-origin, and must also set a vary: origin header to indicate that some headers are being set dynamically depending on the origin. the exact directive for setting headers depends on your web server. in apache, add a line such as the following to the server's configuration (within the appropriate <directory>, <location>, <files>, or <virtualhost> section). the configuration is typically found in a .conf file (httpd.conf and apache.conf are common names for these), or in an .

CORS errors - HTTP
control-allow-origin’ is ‘*’ reason: did not find method in cors header ‘access-control-allow-methods’ reason: expected ‘true’ in cors header ‘access-control-allow-credentials’ reason: cors preflight channel did not succeed reason: invalid token ‘xyz’ in cors header ‘access-control-allow-methods’ reason: invalid token ‘xyz’ in cors header ‘access-control-allow-headers’ reason: missing token ‘xyz’ in cors header ‘access-control-allow-headers’ from cors preflight channel reason: multiple cors header ‘access-control-allow-origin’ not allowed ...

Configuring servers for Ogg media - HTTP
eciate it if you include preload in your video elements. using preload="metadata" will preload the media file's metadata and possibly the first few frames of video. setting payload to auto tells the browser to automatically begin downloading the media as soon as the page is loaded, under the assumption that the user will play it. configuration for older firefox versions serve x-content-duration headers note: as of firefox 41, the x-content-duration header is no longer supported. see bug 1160695 for more details. the ogg format doesn't encapsulate the duration of media, so for the progress bar on the video controls to display the duration of the video, gecko needs to determine the length of the media using other means. there are two ways gecko can do this. the best way is to offer an x-cont...

Connection management in HTTP/1.x - HTTP
http/2 adds additional models for connection management. it's important point to note that connection management in http applies to the connection between two consecutive nodes, which is hop-by-hop and not end-to-end. the model used in connections between a client and its first proxy may differ from the model between a proxy and the destination server (or any intermediate proxies). the http headers involved in defining the connection model, like connection and keep-alive, are hop-by-hop headers with their values able to be changed by intermediary nodes. a related topic is the concept of http connection upgrades, wherein an http/1.1 connection is upgraded to a different protocol, such as tls/1.0, websocket, or even http/2 in cleartext. this protocol upgrade mechanism is documented in more d...

List of default Accept values - HTTP
efore) in firefox 65 and earlier, this value can be modified using the network.http.accept.default parameter. (source) safari, chrome text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 (source) safari 5 text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 this is an improvement over earlier accept headers as it no longer ranks image/png above text/html internet explorer 8 image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/msword, */* see ie and the accept header (ieinternals' msdn blog). edge text/html, application/xhtml+xml, image/jxr, */* opera text/ht...

Cross-Origin Resource Policy (CORP) - HTTP
s, like spectre, as well as cross-site script inclusion attacks. corp is an additional layer of protection beyond the default same-origin policy. cross-origin resource policy complements cross-origin read blocking (corb), which is a mechanism to prevent some cross-origin reads by default. the policy is only effective for no-cors requests, which are issued by default for cors-safelisted methods/headers. as this policy is expressed via a response header, the actual request is not prevented—rather, the browser prevents the result from being leaked by stripping the response body. history the concept was originally proposed in 2012 (as from-origin), but resurrected in q2 of 2018 and implemented in safari and chromium. in early 2018, two side-channel hardware vulnerabilities known as meltdown...

Accept-CH-Lifetime - HTTP
the accept-ch-lifetime header is set by the server to specify the persistence of accept-ch header value that specifies for which client hints headers client should include in subsequent requests. header type response header forbidden header name ? note: client hints are accessible only on secure origins (via tls). accept-ch and accept-ch-lifetime headers should be persisted for all secure requests to ensure client hints are sent reliably. syntax accept-ch-lifetime: <age> examples accept-ch: viewport-width, dpr accept-ch-lifetime: 86400 ...

Accept-CH - HTTP
the accept-ch header is set by the server to specify which client hints headers a client should include in subsequent requests. header type response header forbidden header name ? note: client hints are accessible only on secure origins (via tls). accept-ch and accept-ch-lifetime headers should be persisted for all secure requests to ensure client hints are sent reliably. syntax accept-ch: <list of client hints> examples accept-ch: dpr, viewport-width accept-ch: width accept-ch-lifetime: 86400 vary: dpr, viewport-width, width note: remember to vary the response based on the accepted client hints. ...

Access-Control-Allow-Credentials - HTTP
dentials response header tells browsers whether to expose the response to frontend javascript code when the request's credentials mode (request.credentials) is include. when a request's credentials mode (request.credentials) is include, browsers will only expose the response to frontend javascript code if the access-control-allow-credentials value is true. credentials are cookies, authorization headers or tls client certificates. when used as part of a response to a preflight request, this indicates whether or not the actual request can be made using credentials. note that simple get requests are not preflighted, and so if a request is made for a resource with credentials, if this header is not returned with the resource, the response is ignored by the browser and not returned to web content. ...

Access-Control-Max-Age - HTTP
header type response header forbidden header name no syntax access-control-max-age: <delta-seconds> directives <delta-seconds> maximum number of seconds the results can be cached. uxp caps this at 24 hours (86400 seconds). chromium (prior to v76) caps at 10 minutes (600 seconds). chromium (starting in v76) caps at 2 hours (7200 seconds). ...

Cache-Control - HTTP
ontent-encoding, content-range, or content-type. it therefore forbids a proxy or browser feature, such as google’s web light, from converting images to minimize data for a cache store or slow connection. only-if-cached set by the client to indicate "do not use the network" for the response. the cache should either respond using a stored response, or respond with a 504 status code. conditional headers such as if-none-match should not be set. there is no effect if only-if-cached is set by a server as part of a response. examples preventing caching to disable caching of a resource, you can send the following response header: good: cache-control: no-store bad: cache-control: private,no-cache,no-store,max-age=0,must-revalidate,pre-check=0,post-check=0 caching static assets for...

Content-Location - HTTP
— the site could serve the different filetypes with any url patterns it wishes, such as a query string parameter: /documents/foo?format=json, /documents/foo?format=xml, and so on. then the client could remember that the json version is available at that particular url, skipping content negotation the next time it requests that document. the server could also consider other content negotiation headers, such as accept-language. pointing to a new document (http 201 created) say you're creating a new blog post through a site's api: put /new/post host: example.com content-type: text/markdown # my first blog post! i made this through `example.com`'s api. i hope it worked. the site returns a generic success message confirming the post was published. the server specifies where the new post is ...

CSP: base-uri - HTTP
y that root script. at the same time, any allow-list or source expressions such as 'self' or 'unsafe-inline' are ignored. see script-src for an example. 'report-sample' requires a sample of the violating code to be included in the violation report. examples meta tag configuration <meta http-equiv="content-security-policy" content="base-uri 'self'"> apache configuration <ifmodule mod_headers.c> header set content-security-policy "base-uri 'self'"; </ifmodule> nginx configuration add_header content-security-policy "base-uri 'self';" violation case since your domain isn't example.com, a <base> element with its href set to https://example.com will result in a csp violation. <meta http-equiv="content-security-policy" content="base-uri 'self'"> <base href="https://example.com/"> // ...

CSP: form-action - HTTP
hat root script. at the same time, any allow-list or source expressions such as 'self' or 'unsafe-inline' are ignored. see script-src for an example. 'report-sample' requires a sample of the violating code to be included in the violation report. examples meta tag configuration <meta http-equiv="content-security-policy" content="form-action 'none'"> apache configuration <ifmodule mod_headers.c> header set content-security-policy "form-action 'none'; </ifmodule> nginx configuration add_header content-security-policy "form-action 'none';" violation case using a <form> element with an action set to inline javascript will result in a csp violation. <meta http-equiv="content-security-policy" content="form-action 'none'"> <form action="javascript:alert('foo')" id="form1" method="post...

Content-Type - HTTP
t, resulting from an html form submission, the content-type of the request is specified by the enctype attribute on the <form> element. ...

DPR - HTTP
the dpr header is a client hints headers which represents the client device pixel ratio (dpr), which is the the number of physical device pixels corresponding to every css pixel. header type request header forbidden header name ? note: client hints are accessible only on secure origins (via tls). server has to opt in to receive dpr header from the client by sending accept-ch and accept-ch-lifetime response headers. syntax dpr: <number> examples server first needs to opt in to receive dpr header by sending the response headers accept-ch containing dpr and accept-ch-lifetime. accept-ch: dpr accept-ch-lifetime: 86400 then on subsequent requests the client might send dpr header back: dpr: 1.0 ...

Date - HTTP
the date general http header contains the date and time at which the message was originated. note that date is listed in the forbidden header names in the fetch spec - so this code will not send date header: fetch('https://httpbin.org/get', { 'headers': { 'date': (new date()).toutcstring() } }) header type general header forbidden header name yes syntax date: <day-name>, <day> <month> <year> <hour>:<minute>:<second> gmt directives <day-name> one of "mon", "tue", "wed", "thu", "fri", "sat", or "sun" (case-sensitive). <day> 2 digit day number, e.g. "04" or "23". <month> one of "jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec" (case sensitive). <year> 4 digit year number, e.g. "1990" or "2016". <hour>...

Digest - HTTP
resource representation and encoding the result. the choice of digest algorithm also determines the encoding to use: for example sha-256 uses base64 encoding. examples digest: sha-256=x48e9qookqqrvdts8nojrjn3owduoywxbf7kbu9dbpe= digest: sha-256=x48e9qookqqrvdts8nojrjn3owduoywxbf7kbu9dbpe=,unixsum=30637 specifications specification title draft-ietf-httpbis-digest-headers-latest resource digests for http this header was originally defined in rfc 3230, but the definition of "selected representation" in rfc 7231 made the original definition inconsistent with current http specifications. when released, the "resource digests for http" draft therefore will obsolete rfc 3230 and will update the standard to be consistent. ...

ETag - HTTP
c-tr34". the method by which etag values are generated is not specified. often, a hash of the content, a hash of the last modification timestamp, or just a revision number is used. for example, mdn uses a hexadecimal hash of the wiki article content. examples etag: "33a64df551425fcc55e4d42a148795d9f25f89d4" etag: w/"0815" avoiding mid-air collisions with the help of the etag and the if-match headers, you can detect mid-air edit collisions. for example, when editing mdn, the current wiki content is hashed and put into an etag in the response: etag: "33a64df551425fcc55e4d42a148795d9f25f89d4" when saving changes to a wiki page (posting data), the post request will contain the if-match header containing the etag values to check freshness against. if-match: "33a64df551425fcc55e4d42a148795d9f2...

Expect - HTTP
message body in this request and wishes to receive a 100 (continue) interim response. examples large message body a client sends a request with a expect header and waits for the server to respond before sending the message body. put /somewhere/fun http/1.1 host: origin.example.com content-type: video/h264 content-length: 1234567890987 expect: 100-continue the server now checks the request headers and may respond with a 100 (continue) response to instruct the client to go ahead and send the message body, or it will send a 417 (expectation failed) status if any of the expectations cannot be met. specifications specification title rfc 7231, section 5.1.1: expect hypertext transfer protocol (http/1.1): semantics and content ...

Forwarded - HTTP
this header is used for debugging, statistics, and generating location-dependent content and by design it exposes privacy sensitive information, such as the ip address of the client. ...

Last-Modified - HTTP
the last-modified response http header contains the date and time at which the origin server believes the resource was last modified. it is used as a validator to determine if a resource received or stored is the same. less accurate than an etag header, it is a fallback mechanism. conditional requests containing if-modified-since or if-unmodified-since headers make use of this field. header type response header forbidden header name no cors-safelisted response header yes syntax last-modified: <day-name>, <day> <month> <year> <hour>:<minute>:<second> gmt directives <day-name> one of "mon", "tue", "wed", "thu", "fri", "sat", or "sun" (case-sensitive). <day> 2 digit day number, e.g. "04" or "23". <month> one of "jan", "feb", "mar", "apr", "may"...

Sec-Fetch-Dest - HTTP
sec-fetch-dest: audioworklet sec-fetch-dest: audioworklet values audio audioworklet document embed empty font image manifest object paintworklet report script serviceworker sharedworker style track video worker xslt nested-document examples todo specifications specification title fetch metadata request headers the sec-fetch-dest http request header ...

Sec-Fetch-Mode - HTTP
cors-safelisted request header syntax sec-fetch-mode: cors sec-fetch-mode: navigate sec-fetch-mode: nested-navigate sec-fetch-mode: no-cors sec-fetch-mode: same-origin sec-fetch-mode: websocket values cors navigate nested-navigate no-cors same-origin websocket examples todo specifications specification title fetch metadata request headers the sec-fetch-mode http request header ...

Sec-Fetch-Site - HTTP
-site same-origin same-site none this request does not relate to any context like site, origin, or frame. this can happen when user had initiated this request by, e.g. directly entering a url in the address bar, opening a bookmark, or draging-and-dropping a file into the browser window. examples todo specifications specification title fetch metadata request headers the sec-fetch-site http request header ...

Sec-Fetch-User - HTTP
cors-safelisted request header syntax sec-fetch-user: ?0 sec-fetch-user: ?1 values the value is a boolean structured header. ?0 the navigation request was triggered by a user activation. ?1 the navigation request was triggered by something other than a user activation. examples todo specifications specification title fetch metadata request headers the sec-fetch-user http request header ...

Sec-WebSocket-Accept - HTTP
that is, this is header is sent from server to client to inform that server is willing to initiate a websocket connection. header type response header forbidden header name no syntax sec-websocket-accept: <hashed key> directives <hashed key> the server takes the value of the sec-websocket-key sent in the handshake request, appends 258eafa5-e914-47da-95ca-c5ab0dc85b11, takes sha-1 of the new value, and is then base64 encoded. ...

Set-Cookie - HTTP
browsers block frontend javascript code from accessing the set cookie header, as required by the fetch spec, which defines set-cookie as a forbidden response-header name that must be filtered out from any response exposed to frontend code. for more information, see the guide on http cookies. ...

Trailer - HTTP
ignature, or post-processing status. the te request header needs to be set to "trailers" to allow trailer fields. header type response header forbidden header name yes syntax trailer: header-names directives header-names http header fields which will be present in the trailer part of chunked messages. these header fields are disallowed: message framing headers (e.g., transfer-encoding and content-length), routing headers (e.g., host), request modifiers (e.g., controls and conditionals, like cache-control, max-forwards, or te), authentication headers (e.g., authorization or set-cookie), or content-encoding, content-type, content-range, and trailer itself. examples chunked transfer encoding using a trailing header in this example, the ex...

Vary - HTTP
the vary header should be set on a 304 not modified response exactly like it would have been set on an equivalent 200 ok response. header type response header forbidden header name no syntax vary: * vary: <header-name>, <header-name>, ... directives * each request for a url is supposed to be treated as a unique and uncacheable request. ...

Via - HTTP
it is used for tracking message forwards, avoiding request loops, and identifying the protocol capabilities of senders along the request/response chain. header type general header forbidden header name yes syntax via: [ <protocol-name> "/" ] <protocol-version> <host> [ ":" <port> ] or via: [ <protocol-name> "/" ] <protocol-version> <pseudonym> directives <protocol-name> optional. the name of the protocol used, such as "http". <protocol-version> the version of the protocol used, such as "1.1". ...

Want-Digest - HTTP
when released, the "resource digests for http" draft therefore will obsolete rfc 3230 and will update the standard to be consistent. ...

X-Frame-Options - HTTP
guration: header set x-frame-options "deny" configuring nginx to configure nginx to send the x-frame-options header, add this either to your http, server or location configuration: add_header x-frame-options sameorigin always; configuring iis to configure iis to send the x-frame-options header, add this to your site's web.config file: <system.webserver> ... <httpprotocol> <customheaders> <add name="x-frame-options" value="sameorigin" /> </customheaders> </httpprotocol> ... </system.webserver> or see this microsoft support article on setting this configuration using the iis manager user interface. configuring haproxy to configure haproxy to send the x-frame-options header, add this to your front-end, listen, or backend configuration: rspadd x-frame-options:\ s...

X-XSS-Protection - HTTP
nables xss filtering. if a cross-site scripting attack is detected, the browser will sanitize the page and report the violation. this uses the functionality of the csp report-uri directive to send a report. example block pages from loading when they detect reflected xss attacks: x-xss-protection: 1; mode=block php header("x-xss-protection: 1; mode=block"); apache (.htaccess) <ifmodule mod_headers.c> header set x-xss-protection "1; mode=block" </ifmodule> nginx add_header "x-xss-protection" "1; mode=block"; specifications not part of any specifications or drafts. ...

PATCH - HTTP
crementing counter field is an integral part of the resource, then a put will naturally overwrite it (since it overwrites everything), but not necessarily so for patch. patch (like put) may have side-effects on other resources. to find out whether a server supports patch, a server can advertise its support by adding it to the list in the allow or access-control-allow-methods (for cors) response headers. another (implicit) indication that patch is allowed, is the presence of the accept-patch header, which specifies the patch document formats accepted by the server. request has body yes successful response has body yes safe no idempotent no cacheable no allowed in html forms no syntax patch /file.txt http/1.1 exam...

Redirections in HTTP - HTTP
copy (that was stale), and 300 (multiple choice) is a manual redirection: the body, presented by the browser as a web page, lists the possible redirections and the user clicks on one to select it. code text typical use case 300 multiple choice not many: the choices are listed in an html page in the body. machine-readable choices are encouraged to be sent as link headers with rel=alternate. 304 not modified sent for revalidated conditional requests. indicates that the cached response is still fresh and can be used. alternative way of specifying redirections http redirects aren't the only way to define redirections. there are two others: html redirections with the <meta> element javascript redirections via the dom html redirections ht...

100 Continue - HTTP
the http 100 continue informational status response code indicates that everything so far is ok and that the client should continue with the request or ignore it if it is already finished. to have a server check the request's headers, a client must send expect: 100-continue as a header in its initial request and receive a 100 continue status code in response before sending the body. status 100 continue specifications specification title rfc 7231, section 6.2.1: 100 continue hypertext transfer protocol (http/1.1): semantics and content ...

200 OK - HTTP
post: the resource describing the result of the action is transmitted in the message body. trace: the message body contains the request message as received by the server. ...

301 Moved Permanently - HTTP
a browser redirects to this page and search engines update their links to the resource (in 'seo-speak', it is said that the 'link-juice' is sent to the new url). even if the specification requires the method (and the body) not to be altered when the redirection is performed, not all user-agents align with it - you can still find this type of bugged software out there. ...

304 Not Modified - HTTP
ttp 304 not modified client redirection response code indicates that there is no need to retransmit the requested resources. it is an implicit redirection to a cached resource. this happens when the request method is safe, like a get or a head request, or when the request is conditional and uses a if-none-match or a if-modified-since header. the equivalent 200 ok response would have included the headers cache-control, content-location, date, etag, expires, and vary. many developer tools' network panels of browsers create extraneous requests leading to 304 responses, so that access to the local cache is visible to developers. status 304 not modified specifications specification title rfc 7232, section 4.1: 304 not modified hypertext transfer protocol (http/1.1): con...

307 Temporary Redirect - HTTP
the method and the body of the original request are reused to perform the redirected request. in the cases where you want the method used to be changed to get, use 303 see other instead. this is useful when you want to give an answer to a put method that is not the uploaded resources, but a confirmation message (like "you successfully uploaded xyz"). ...

308 Permanent Redirect - HTTP
a browser redirects to this page and search engines update their links to the resource (in 'seo-speak', it is said that the 'link-juice' is sent to the new url). the request method and the body will not be altered, whereas 301 may incorrectly sometimes be changed to a get method. note: some web applications may use the 308 permanent redirect in a non-standard way and for other purposes. ...

406 Not Acceptable - HTTP
the hypertext transfer protocol (http) 406 not acceptable client error response code indicates that the server cannot produce a response matching the list of acceptable values defined in the request's proactive content negotiation headers, and that the server is unwilling to supply a default representation. proactive content negotiation headers include: accept accept-charset accept-encoding accept-language in practice, this error is very rarely used. instead of responding using this error code, which would be cryptic for the end user and difficult to fix, servers ignore the relevant header and serve an actual page to the user. it is assumed that even if the user won't be completely happy, they will prefer this to an error code. if a server returns such an error status, the body of the ...

412 Precondition Failed - HTTP
the hypertext transfer protocol (http) 412 precondition failed client error response code indicates that access to the target resource has been denied. this happens with conditional requests on methods other than get or head when the condition defined by the if-unmodified-since or if-none-match headers is not fulfilled. in that case, the request, usually an upload or a modification of a resource, cannot be made and this error response is sent back. status 412 precondition failed examples etag: "33a64df551425fcc55e4d42a148795d9f25f89d4" etag: w/"0815" avoiding mid-air collisions with the help of the etag and the if-match headers, you can detect mid-air edit collisions. for example, when editing mdn, the current wiki content is hashed and put into an etag in the response: etag: "33a64df551...

501 Not Implemented - HTTP
t servers are required to support (and therefore that must not return 501) are get and head. if the server does recognize the method, but intentionally does not support it, the appropriate response is 405 method not allowed. a 501 error is not something you can fix, but requires a fix by the web server you are trying to access. a 501 response is cacheable by default; that is, unless caching headers instruct otherwise. status 501 not implemented specifications specification title rfc 7231, section 6.6.2: 501 not implemented hypertext transfer protocol (http/1.1): semantics and content ...

503 Service Unavailable - HTTP
r is not ready to handle the request. common causes are a server that is down for maintenance or that is overloaded. this response should be used for temporary conditions and the retry-after http header should, if possible, contain the estimated time for the recovery of the service. note: together with this response, a user-friendly page explaining the problem should be sent. caching-related headers that are sent along with this response should be taken care of, as a 503 status is often a temporary condition and responses shouldn't usually be cached. status 503 service unavailable specifications specification title rfc 7231, section 6.6.4: 503 service unavailable hypertext transfer protocol (http/1.1): semantics and content ...

Closures - JavaScript
an event that is triggered by the user (such as a click or a keypress). the code is attached as a callback (a single function that is executed in response to the event). for instance, suppose we want to add buttons to a page to adjust the text size. one way of doing this is to specify the font-size of the body element (in pixels), and then set the size of the other elements on the page (such as headers) using the relative em unit: body { font-family: helvetica, arial, sans-serif; font-size: 12px; } h1 { font-size: 1.5em; } h2 { font-size: 1.2em; } such interactive text size buttons can change the font-size property of the body element, and the adjustments are picked up by other elements on the page thanks to the relative units. here's the javascript: function makesizer(size) { ...

Promise.prototype.finally() - JavaScript
) => {}) (which will be fulfilled with undefined), promise.reject(3).finally(() => {}) will be rejected with 3. note: a throw (or returning a rejected promise) in the finally callback will reject the new promise with the rejection reason specified when calling throw. examples using finally let isloading = true; fetch(myrequest).then(function(response) { var contenttype = response.headers.get("content-type"); if(contenttype && contenttype.includes("application/json")) { return response.json(); } throw new typeerror("oops, we haven't got json!"); }) .then(function(json) { /* process your json further */ }) .catch(function(error) { console.error(error); /* this line can also throw, e.g. when console = {} */ }) .finally(function() { isloading = false; }); ...

Promise.prototype.then() - JavaScript
}); you can also use chaining to implement one function with a promise-based api on top of another such function. function fetch_current_data() { // the fetch() api returns a promise. this function // exposes a similar api, except the fulfillment // value of this function's promise has had more // work done on it. return fetch('current-data.json').then(response => { if (response.headers.get('content-type') != 'application/json') { throw new typeerror(); } var j = response.json(); // maybe do something with j return j; // fulfillment value given to user of // fetch_current_data().then() }); } if onfulfilled returns a promise, the return value of then will be resolved/rejected by the promise. function resolvelater(resolve, reject) { setti...

SharedArrayBuffer - JavaScript
re effectively disabled at the start of 2018 in light of spectre. in 2020, a new, secure approach has been standardized to re-enable shared memory. with a few security measures, postmessage() will no longer throw for sharedarraybuffer objects and shared memory across threads will be available: as a baseline requirement, your document needs to be in a secure context. ...

encodeURIComponent() - JavaScript
o be more stringent in adhering to rfc 3986 (which reserves !, ', (, ), and *), even though these characters have no formalized uri delimiting uses, the following can be safely used: function fixedencodeuricomponent(str) { return encodeuricomponent(str).replace(/[!'()*]/g, function(c) { return '%' + c.charcodeat(0).tostring(16); }); } examples encoding for content-disposition and link headers the following example provides the special encoding required within utf-8 content-disposition and link server response header parameters (e.g., utf-8 filenames): var filename = 'my file(2).txt'; var header = "content-disposition: attachment; filename*=utf-8''" + encoderfc5987valuechars(filename); console.log(header); // logs "content-disposition: attachment; filename*=utf-8''my%20...

Critical rendering path - Web Performance
s important to ensure reflows and repaints can happen at 60 frames per second, to ensure performant user interactions and avoid jank. understanding crp web performance includes the server requests and responses, loading, scripting, rendering, layout, and the painting of the pixels to the screen. a request for a web page or app starts with an html request. the server returns the html - response headers and data. the browser then begins parsing the html, converting the received bytes to the dom tree. the browser initiates requests every time it finds links to external resources, be they stylesheets, scripts, or embedded image references. some requests are blocking, which means the parsing of the rest of the html is halted until the imported asset is handled. the browser continues to parse the ht...

Populating the page: how browsers work - Web Performance
e browser and the web server cannot be decrypted by a third party. after the 8 round trips, the browser is finally able to make the request. response once we have an established connection to a web server, the browser sends an initial http get request on behalf of the user, which for websites is most often an html file. once the server receives the request, it will reply with relevant response headers and the contents of the html. <!doctype html> <html> <head> <meta charset="utf-8"/> <title>my simple page</title> <link rel="stylesheet" src="styles.css"/> <script src="myscript.js"></script> </head> <body> <h1 class="heading">my page</h1> <p>a paragraph with a <a href="https://example.com/about">link</a></p> <div> <img src="myimage.jpg" alt="image description"/> </div> <s...

Web Performance
as we tend to call it—is crucial in creating secure and safe user experiences. while hardware has reduced the negative impacts tls has had on server performance, it still represents a substantial slice of the time we spend waiting for browsers to connect to servers. this article explains the tls handshake process, and offers some tips for reducing this time, such as ocsp stapling, hsts preload headers, and the potential role of resource hints in masking tls latency for third parties. reading performance charts developer tools provide information on performance, memory, and network requests. knowing how to read waterfall charts, call trees, traces, flame charts , and allocations in your browser developer tools will help you understand waterfall and flame charts in other performance tools. ...

Media - Progressive web apps (PWAs)
to one inch on all four sides: @page {margin: 1in;} this rule ensures that every h1 element starts on a new page: h1 {page-break-before: always;} more details for full details of css support for paged media, see paged media in the css specification. like other features of css, printing depends on browser choice and its settings. for example, the mozilla browser supplies default margins, headers, and footers for printing. keep in mind that you can't completely control the printed format. it is impossible to anticipate every user's browser choice and settings at the time of printing. user interfaces css has some special properties for devices that support a user interface, like computer displays. these properties dynamically change the appearance of content as the user works with the i...

Introduction - SVG: Scalable Vector Graphics
s had been submitted to the w3c and failed to be fully ratified. svg is supported by all major browsers. a downside is loading svg can be slow. svg does offer benefits, some of which include having a dom interface available for it, and not requiring third-party extensions. whether or not to use it often depends on your specific use case. basic ingredients html provides elements for defining headers, paragraphs, tables, and so on. in much the same way svg provides elements for circles, rectangles, and simple and complex curves. a simple svg document consists of nothing more than the <svg> root element and several basic shapes that build a graphic together. in addition there is the <g> element, which is used to group several basic shapes together. starting from there, the svg image can becom...

mimeTypes.rdf corruption - SVG: Scalable Vector Graphics
he of filename extension to media type mappings (stored in a mozilla profile file called mimetypes.rdf), and if it doesn't find a media type there, it asks the operating system. actually, in mozilla firefox 1.5, the media type for files embedded into html using the html <embed> and <object> tags is (unfortunately) obtained in the same way as it's obtained for local files instead of using the http headers as it should. this bug has been fixed in trunk builds. problems in the way mozilla obtains the media type for files loaded locally can occur in two ways. first, certain actions can cause the media types cache in mimetypes.rdf to associate a filename extension with the wrong media type. second, certain actions may cause the os to associate a filename extension with the wrong media type. if either ...

Web security
ryptographic hash that a fetched resource must match. http access-control-allow-origin the access-control-allow-origin response header indicates whether the response can be shared with requesting code from the given origin. http x-content-type-options the x-content-type-options response http header is a marker used by the server to indicate that the mime types advertised in the content-type headers should not be changed and be followed. this is a way to opt out of mime type sniffing, or, in other words, to say that the mime types are deliberately configured. clickjacking protection in clickjacking, a user is fooled into clicking on a ui element that performs some action other than what the user expects. http x-frame-options the x-frame-options http response header can be used to i...