fetchLater corrections and updates

files/en-us/web/api/deferredrequestinit/index.md

@@ -41,16 +41,11 @@ fetchLater("/send_beacon");
 In this example we create a {{domxref("Request")}}, and provide an `activateAfter` value to delay sending the request for 60,000 milliseconds (or one minute):
 
 ```js
-fetchLater(
-  {
-    url: "/send_beacon",
-    method: "POST",
-    body: getBeaconData(),
-  },
-  {
-    activateAfter: 60000, // 1 minute
-  },
-);
+fetchLater("/send_beacon", {
+  method: "POST",
+  body: getBeaconData(),
+  activateAfter: 60000, // 1 minute
+});
 ```
 
 > [!NOTE]

files/en-us/web/api/fetchlater_api/fetchlater_quotas/index.md

@@ -150,13 +150,27 @@ Assuming a top-level document on `a.com`, which embeds a `<iframe src="https://b
 2. `<iframe src="https://b.com/">` receives 8KiB of the default shared quota.
 3. The 8KiB is not transferred to `c.com` when `<iframe src="https://b.com/">` redirects to there, but the 8KiB is not released.
 
-### Redirects of subframes back to the top-level origin allow use of the top-level quota
+### Sandboxed same-origin iframes are effectively separate origins
 
-Assuming a top-level document on `a.com`, which embeds a `<iframe src="https://b.com/">`, which redirects to `a.com`, and no explicit top-level Permission Policies.
+As an example, if the following `<iframe>` is embedded on `https://www.example.com`:
 
-1. The top-level frame of `a.com` has the default 512KiB quota.
-2. `<iframe src="https://b.com/">` receives 8KiB of the default shared quota.
-3. The 8KiB is not transferred to `a.com` when `<iframe src="https://b.com/">` redirects to there, but it is able to share the full top-level quota again, and the 8KiB is released.
+```html
+<iframe src="https://www.example.com/iframe" sandbox="allow-scripts"></iframe>
+```
+
+This would not be considered "same-origin", despite being hosted on the same origin as the top-level document, as the `<iframe>` is in a sandboxed environment. Therefore, by default, it should be allocated an 8KiB quota from the total shared 128KiB quota.
+
+### Disallowing `fetchLater()` from iframes
+
+You can use the `<iframe>` [`allow`](/en-US/docs/Web/HTML/Reference/Elements/iframe#allow) attribute to prevent `fetchLater()` quota from being allocated to the `<iframe>`:
+
+```html
+<iframe
+  src="https://www.example.com/iframe"
+  allow="deferred-fetch;deferred-fetch-minimal;"></iframe>
+```
+
+The `allow="deferred-fetch"` directive is needed to prevent same-origin iframes from using up the 512KiB quota, and the `allow="deferred-fetch-minimal"` directive is needed to prevent cross-origin iframes from using up the 128KiB quota. Including both directives will prevent both quotas from being used, regardless of the `src` value.
 
 ### Examples which throw a `QuotaExceededError`
 
@@ -190,6 +204,14 @@ fetchLater("https://b.example.com", { method: "POST", body: a_40kb_body });
 fetchLater("https://a.example.com", { method: "POST", body: a_40kb_body });
 ```
 
+### Redirects of subframes back to the top-level origin allow use of the top-level quota
+
+Assuming a top-level document at `a.com`, which embeds `<iframe src="https://b.com/">`, which redirects to `a.com`, and no explicit top-level Permission Policies:
+
+1. The top-level frame of `a.com` has the default 512KiB quota.
+2. `<iframe src="https://b.com/">` receives 8KiB of the default shared quota of 128KiB.
+3. The 8KiB is not transferred to `a.com` when `<iframe src="https://b.com/">` redirects there, but it can share the full top-level quota again, and the previously-allocated 8KiB quota is released.
+
 ## Specifications
 
 {{Specifications}}

files/en-us/web/api/window/fetchlater/index.md

@@ -79,16 +79,11 @@ fetchLater("/send_beacon");
 In this example we create a {{domxref("Request")}}, and provide an `activateAfter` value to delay sending the request for 60,000 milliseconds (or one minute):
 
 ```js
-fetchLater(
-  {
-    url: "/send_beacon",
-    method: "POST",
-    body: getBeaconData(),
-  },
-  {
-    activateAfter: 60000, // 1 minute
-  },
-);
+fetchLater("/send_beacon", {
+  method: "POST",
+  body: getBeaconData(),
+  activateAfter: 60000, // 1 minute
+});
 ```
 
 > [!NOTE]
@@ -100,16 +95,11 @@ The same example as above, but the best practice is to enclose this in a try/cat
 
 ```js
 try {
-  fetchLater(
-    {
-      url: "/send_beacon",
-      method: "POST",
-      body: getBeaconData(),
-    },
-    {
-      activateAfter: 60000, // 1 minute
-    },
-  );
+  fetchLater("/send_beacon", {
+    method: "POST",
+    body: getBeaconData(),
+    activateAfter: 60000, // 1 minute
+  });
 } catch (e) {
   if (e instanceof QuotaExceededError) {
     // Handle the quota error