I think it's reasonable for us to dig into the data a little bit to determine whether the 0.04% number quoted above will result in user-facing breakage. Yutaka, is that something you'd be willing to dig into?
The direction seems philosophically correct to me, so I'd like to see it ship, but I'd also like to make sure we're not making the web worse for users by doing so. -mike On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> wrote: > > > On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> wrote: > >> >> >> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano <[email protected]> >> wrote: >> >>> (The implementation CL >>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> is >>> under review. This intent is written as if it's landed.) >>> >>> Contact [email protected] >>> >>> Specification >>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>> >>> Summary >>> >>> A CORS non-wildcard request header[1] is an HTTP request header which is >>> not covered by the wildcard symbol ("*") in the >>> access-control-allow-headers header. "authorization" is the only member of >>> CORS non-wildcard request-header. Currently we treat the header as a usual >>> header, which is problematic for security reasons. Implement it, and change >>> the current behavior. 1: >>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>> >>> >>> Blink componentBlink>SecurityFeature>CORS >>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>> >>> TAG reviewNot needed because this implements an existing feature. >>> >>> TAG review statusNot applicable >>> >>> Risks >>> >>> >>> Interoperability and Compatibility >>> >>> Interoperability risk is low because Mozilla and Apple showed an intent >>> to implement this behavior. There is some compatibility risk, as the use >>> counter[2] shows 0.04% websites would be affected. To mitigate the risk, >>> we've shown a deprecation message for a few milestones. >>> >> >> Can you similarly send deprecation reports as well? How long have the >> deprecation messages been in place? Did we see any decline in the numbers? >> >> We've shown the deprecation message since Chrome 94 > <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> > whose > beta promotion was on Aug 26 and stable release was on Sep 21. > We use CountDeprecation which sends deprecation reports automatically IIUC. > > I don't see any decline. > > >> Have we looked into which URLs are triggering this? (and if it's a few >> medium-sized properties or many tiny ones) >> > > I haven't looked at the data. > >> Did we try outreach? >> > No. > >> >> We have an enterprise policy so that administrators can keep the existing >>> behavior. We're planning to remove the policy on Chrome 103. 2: >>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>> ByWildcard >>> >>> >>> Gecko: Positive Firefox showed a positive signal in a private thread. >>> >>> WebKit: Positive Apple showed a positive signal in a private thread. >>> >>> Web developers: No signals >>> >>> >>> Debuggability >>> >>> We'll show a CORS error to the devtools console. >>> >>> >>> Is this feature fully tested by web-platform-tests >>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>> ?Yes >>> >>> Flag nameCorsNonWildcardRequestHeadersSupport >>> >>> Requires code in //chrome?False (or, True only for the enterprise >>> policy.) >>> >>> Tracking bughttps://crbug.com/1176753 >>> >>> Estimated milestones >>> >>> 97 >>> >>> Link to entry on the Chrome Platform Status >>> https://chromestatus.com/feature/5742041264816128 >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "blink-dev" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> To view this discussion on the web visit >>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>> . >>> >> -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAKXHy%3DehYWh0ri8-veAUeojYW%2BC2QXXoFaWhoTES4DR%2BtfJKhQ%40mail.gmail.com.
