Friendly ping on Chris' question On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson wrote:
> Would it be feasible to get a random list of 10-20 sites that hit the use > counter and see if they are broken badly by this feature? > > On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> wrote: > >> (friendly ping) >> >> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >> wrote: >> >>> Thank you for the feedback. >>> >>> Do you have concrete steps for the investigation in your mind? >>> >>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> wrote: >>> >>>> I think it's reasonable for us to dig into the data a little bit to >>>> determine whether the 0.04% number quoted above will result in user-facing >>>> breakage. Yutaka, is that something you'd be willing to dig into? >>>> >>>> The direction seems philosophically correct to me, so I'd like to see >>>> it ship, but I'd also like to make sure we're not making the web worse for >>>> users by doing so. >>>> >>>> -mike >>>> >>>> >>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> >>>> wrote: >>>> >>>>> >>>>> >>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >>>>> wrote: >>>>> >>>>>> >>>>>> >>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> (The implementation CL >>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>> is under review. This intent is written as if it's landed.) >>>>>>> >>>>>>> Contact [email protected] >>>>>>> >>>>>>> Specification >>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>> >>>>>>> Summary >>>>>>> >>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>> access-control-allow-headers header. "authorization" is the only member >>>>>>> of >>>>>>> CORS non-wildcard request-header. Currently we treat the header as a >>>>>>> usual >>>>>>> header, which is problematic for security reasons. Implement it, and >>>>>>> change >>>>>>> the current behavior. 1: >>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>> >>>>>>> >>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>> >>>>>>> TAG reviewNot needed because this implements an existing feature. >>>>>>> >>>>>>> TAG review statusNot applicable >>>>>>> >>>>>>> Risks >>>>>>> >>>>>>> >>>>>>> Interoperability and Compatibility >>>>>>> >>>>>>> Interoperability risk is low because Mozilla and Apple showed an >>>>>>> intent to implement this behavior. There is some compatibility risk, as >>>>>>> the >>>>>>> use counter[2] shows 0.04% websites would be affected. To mitigate the >>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>> >>>>>> >>>>>> Can you similarly send deprecation reports as well? How long have the >>>>>> deprecation messages been in place? Did we see any decline in the >>>>>> numbers? >>>>>> >>>>>> We've shown the deprecation message since Chrome 94 >>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>> whose >>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>> We use CountDeprecation which sends deprecation reports automatically >>>>> IIUC. >>>>> >>>>> I don't see any decline. >>>>> >>>>> >>>>>> Have we looked into which URLs are triggering this? (and if it's a >>>>>> few medium-sized properties or many tiny ones) >>>>>> >>>>> >>>>> I haven't looked at the data. >>>>> >>>>>> Did we try outreach? >>>>>> >>>>> No. >>>>> >>>>>> >>>>>> We have an enterprise policy so that administrators can keep the >>>>>>> existing behavior. We're planning to remove the policy on Chrome 103. >>>>>>> 2: >>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>> ByWildcard >>>>>>> >>>>>>> >>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>> thread. >>>>>>> >>>>>>> WebKit: Positive Apple showed a positive signal in a private thread. >>>>>>> >>>>>>> Web developers: No signals >>>>>>> >>>>>>> >>>>>>> Debuggability >>>>>>> >>>>>>> We'll show a CORS error to the devtools console. >>>>>>> >>>>>>> >>>>>>> Is this feature fully tested by web-platform-tests >>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>> ?Yes >>>>>>> >>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>> >>>>>>> Requires code in //chrome?False (or, True only for the enterprise >>>>>>> policy.) >>>>>>> >>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>> >>>>>>> Estimated milestones >>>>>>> >>>>>>> 97 >>>>>>> >>>>>>> Link to entry on the Chrome Platform Status >>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>> >>>>>>> -- >>>>>>> You received this message because you are subscribed to the Google >>>>>>> Groups "blink-dev" group. >>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>> send an email to [email protected]. >>>>>>> To view this discussion on the web visit >>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>> >>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>> . >>>>>>> >>>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "blink-dev" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected]. >>>>> To view this discussion on the web visit >>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>> >>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> >>>> -- >> You received this message because you are subscribed to the Google Groups >> "blink-dev" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> > To view this discussion on the web visit >> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >> >> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/5ed154fd-ba1f-44aa-81ac-43d17eb191a5n%40chromium.org.
