Thank you for the feedback. Do you have concrete steps for the investigation in your mind?
On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> wrote: > I think it's reasonable for us to dig into the data a little bit to > determine whether the 0.04% number quoted above will result in user-facing > breakage. Yutaka, is that something you'd be willing to dig into? > > The direction seems philosophically correct to me, so I'd like to see it > ship, but I'd also like to make sure we're not making the web worse for > users by doing so. > > -mike > > > On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> > wrote: > >> >> >> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >> wrote: >> >>> >>> >>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano <[email protected]> >>> wrote: >>> >>>> (The implementation CL >>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> is >>>> under review. This intent is written as if it's landed.) >>>> >>>> Contact [email protected] >>>> >>>> Specification >>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>> >>>> Summary >>>> >>>> A CORS non-wildcard request header[1] is an HTTP request header which >>>> is not covered by the wildcard symbol ("*") in the >>>> access-control-allow-headers header. "authorization" is the only member of >>>> CORS non-wildcard request-header. Currently we treat the header as a usual >>>> header, which is problematic for security reasons. Implement it, and change >>>> the current behavior. 1: >>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>> >>>> >>>> Blink componentBlink>SecurityFeature>CORS >>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>> >>>> TAG reviewNot needed because this implements an existing feature. >>>> >>>> TAG review statusNot applicable >>>> >>>> Risks >>>> >>>> >>>> Interoperability and Compatibility >>>> >>>> Interoperability risk is low because Mozilla and Apple showed an intent >>>> to implement this behavior. There is some compatibility risk, as the use >>>> counter[2] shows 0.04% websites would be affected. To mitigate the risk, >>>> we've shown a deprecation message for a few milestones. >>>> >>> >>> Can you similarly send deprecation reports as well? How long have the >>> deprecation messages been in place? Did we see any decline in the numbers? >>> >>> We've shown the deprecation message since Chrome 94 >> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >> whose >> beta promotion was on Aug 26 and stable release was on Sep 21. >> We use CountDeprecation which sends deprecation reports automatically >> IIUC. >> >> I don't see any decline. >> >> >>> Have we looked into which URLs are triggering this? (and if it's a few >>> medium-sized properties or many tiny ones) >>> >> >> I haven't looked at the data. >> >>> Did we try outreach? >>> >> No. >> >>> >>> We have an enterprise policy so that administrators can keep the >>>> existing behavior. We're planning to remove the policy on Chrome 103. 2: >>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>> ByWildcard >>>> >>>> >>>> Gecko: Positive Firefox showed a positive signal in a private thread. >>>> >>>> WebKit: Positive Apple showed a positive signal in a private thread. >>>> >>>> Web developers: No signals >>>> >>>> >>>> Debuggability >>>> >>>> We'll show a CORS error to the devtools console. >>>> >>>> >>>> Is this feature fully tested by web-platform-tests >>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>> ?Yes >>>> >>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>> >>>> Requires code in //chrome?False (or, True only for the enterprise >>>> policy.) >>>> >>>> Tracking bughttps://crbug.com/1176753 >>>> >>>> Estimated milestones >>>> >>>> 97 >>>> >>>> Link to entry on the Chrome Platform Status >>>> https://chromestatus.com/feature/5742041264816128 >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "blink-dev" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> To view this discussion on the web visit >>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>> . >>>> >>> -- >> You received this message because you are subscribed to the Google Groups >> "blink-dev" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6Hd2v8V1mcgoCWvjuMDTA1QbaFnjG%3DyjyLUesr0-mTaXQ%40mail.gmail.com.
