Sec Speculation Tags

Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.

The HTTP Sec-Speculation-Tags request header contains one or more tag values from the speculation rules that resulted in the speculation. This allows a server to identify which rule(s) caused a speculation and potentially block them.

For example, a CDN may automatically insert speculation rules, but block speculations for resources not cached in the CDN to avoid unintended consequences. The Sec-Speculation-Tags header allows the CDN to differentiate between the rules it has inserted (which should be blocked in this case) and speculation rules added by the site owner (which should not be blocked).

Note: The header helps in managing and controlling speculative execution, enhancing security and performance.

It can be classified as a request header, with the prefix Sec-. It is a forbidden request header starting with the Sec- prefix and is subject to restrictions in certain contexts.

Syntax

Sec-Speculation-Tags:

Directives

A comma-separated list of tags indicating Speculation Rules API rules that may have initiated this request. See Speculation rules JSON representation for the syntax reference.

Examples

Some examples demonstrating the behavior of speculation rules are provided below.

When a speculation occurs due to a speculation rule with no explicit tag, the server receives a header with a null value for Sec-Speculation-Tags.

Example of speculation with no tag:

<script type="speculationrules">
 {
 "prefetch": [
 {
 "urls": ["next.html", "next2.html"]
 }
 ]
 }
</script>

When speculation occurs from a rule without an explicit tag, the header will contain a null value:

Sec-Speculation-Tags: null

Sec-Speculation-Tags: null

If a speculation is triggered based on a rule with a specific tag, then that tag is reported in the header.

Example of speculation with a tag:

<script type="speculationrules">
 {
 "prefetch": [
 {
 "tag": "my-rule",
 "urls": ["next.html", "next2.html"]
 }
 ]
 }
</script>

The header will include the tag name used in the speculation rule:
Sec-Speculation-Tags: “my-rule”

Sec-Speculation-Tags: "my-rule"

When multiple tags are present at different levels of a speculation rule, all corresponding tags are included in the header.

Example with multiple tags:

<script type="speculationrules">
 {
 "tag": "my-ruleset",
 "prefetch": [
 {
 "tag": "my-rule",
 "urls": ["next.html", "next2.html"]
 }
 ]
 }</script>

In this case, the header will list both tags:
Sec-Speculation-Tags: “my-ruleset”, “my-rule”

Sec-Speculation-Tags: "my-ruleset", "my-rule"

Speculation can be triggered by multiple rules. For example:

<script type="speculationrules">
 {
 "prefetch": [
 {
 "tag": "my-rule",
 "urls": ["next.html", "next2.html"],
 "eagerness": "moderate"
 }
 ]
 }</script>
<script type="speculationrules">
 {
 "prefetch": [
 {
 "tag": "cdn-rule",
 "urls": ["next.html", "next.html"],
 "eagerness": "conservative"
 }
 ]
 }</script>

If the user hovers over a link for 200 milliseconds, only the ‘my-rule’ tag is sent in the header, as the speculation is initiated by the first rule. If the user clicks immediately, both rules are triggered, and both tags are included:
Sec-Speculation-Tags: “my-rule”, “cdn-rule”

Sec-Speculation-Tags: "my-rule", "cdn-rule"

Multiple rules with and without tags can be combined, with rules without tags represented as nulls in the header. For example:

<script type="speculationrules">
 {
 "prefetch": [
 {
 "urls": ["next.html", "next2.html"],
 "eagerness": "moderate"
 }
 ]
 }</script>
<script type="speculationrules">
 {
 "prefetch": [
 {
 "tag": "cdn-rule",
 "urls": ["next.html", "next.html"],
 "eagerness": "conservative"
 }
 ]
 }</script>

In this scenario, if a user triggers immediate speculation, the header will include
Sec-Speculation-Tags: null, “cdn-rule”

How to Modify Header using Requestly

Requestly is a powerful Chrome extension that allows you to modify HTTP headers, including the Sec-Speculation-Tags header. This can be helpful for testing how your browser or application handles speculative execution controls and security-related features. Steps to Modify the Sec Speculation Tags Header:

1. Install and open the Requestly Chrome extension. You can find it on the Chrome Web Store.
2. Create a new rule: Click on “Create Rule” and choose “Modify Headers” from the list of available rule types.
3. Add a new header modification:
   • Under “Action”, select “Add” or “Override”.
   • In the “Header Name” field, enter Sec-Speculation-Tags.
   • In the “Header Value” field, enter your preferred value (e.g., 1 or any specific tag you want to test).
4. Set the URL condition: Specify the URL or pattern where this header change should apply (e.g., https://your-api.com/\*).
5. Save the rule.

Once configured, Requestly will insert the Sec-Speculation-Tags header into all matching requests, enabling you to test how different speculative execution tags affect your application or browser behavior. Modifying the Sec-Speculation-Tags header can help developers simulate and debug security features related to speculative execution attacks, ensuring their applications handle these tags correctly for improved protection and performance.