Sorry for the delay! I checked 10 sites. I saw console errors in three sites among them: 1. https://cchatty.com/ 2. https://techrxiv.org/ 3. https://bodyshake.com/
I only see a visible breakage in 1 (cards in the main panel are invisible). On other sites I don't see any visible differences. Please note that this feature is related to authorization so it is likely to break things when signing in. On Wed, Dec 1, 2021 at 8:11 PM Yoav Weiss <[email protected]> wrote: > Friendly ping on Chris' question > > On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson wrote: > >> Would it be feasible to get a random list of 10-20 sites that hit the use >> counter and see if they are broken badly by this feature? >> >> On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> >> wrote: >> >>> (friendly ping) >>> >>> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >>> wrote: >>> >>>> Thank you for the feedback. >>>> >>>> Do you have concrete steps for the investigation in your mind? >>>> >>>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> wrote: >>>> >>>>> I think it's reasonable for us to dig into the data a little bit to >>>>> determine whether the 0.04% number quoted above will result in user-facing >>>>> breakage. Yutaka, is that something you'd be willing to dig into? >>>>> >>>>> The direction seems philosophically correct to me, so I'd like to see >>>>> it ship, but I'd also like to make sure we're not making the web worse for >>>>> users by doing so. >>>>> >>>>> -mike >>>>> >>>>> >>>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> >>>>> wrote: >>>>> >>>>>> >>>>>> >>>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> >>>>>>> >>>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> (The implementation CL >>>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>>> is under review. This intent is written as if it's landed.) >>>>>>>> >>>>>>>> Contact [email protected] >>>>>>>> >>>>>>>> Specification >>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>> >>>>>>>> Summary >>>>>>>> >>>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>>> access-control-allow-headers header. "authorization" is the only >>>>>>>> member of >>>>>>>> CORS non-wildcard request-header. Currently we treat the header as a >>>>>>>> usual >>>>>>>> header, which is problematic for security reasons. Implement it, and >>>>>>>> change >>>>>>>> the current behavior. 1: >>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>> >>>>>>>> >>>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>>> >>>>>>>> TAG reviewNot needed because this implements an existing feature. >>>>>>>> >>>>>>>> TAG review statusNot applicable >>>>>>>> >>>>>>>> Risks >>>>>>>> >>>>>>>> >>>>>>>> Interoperability and Compatibility >>>>>>>> >>>>>>>> Interoperability risk is low because Mozilla and Apple showed an >>>>>>>> intent to implement this behavior. There is some compatibility risk, >>>>>>>> as the >>>>>>>> use counter[2] shows 0.04% websites would be affected. To mitigate the >>>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>>> >>>>>>> >>>>>>> Can you similarly send deprecation reports as well? How long have >>>>>>> the deprecation messages been in place? Did we see any decline in the >>>>>>> numbers? >>>>>>> >>>>>>> We've shown the deprecation message since Chrome 94 >>>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>>> whose >>>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>>> We use CountDeprecation which sends deprecation reports automatically >>>>>> IIUC. >>>>>> >>>>>> I don't see any decline. >>>>>> >>>>>> >>>>>>> Have we looked into which URLs are triggering this? (and if it's a >>>>>>> few medium-sized properties or many tiny ones) >>>>>>> >>>>>> >>>>>> I haven't looked at the data. >>>>>> >>>>>>> Did we try outreach? >>>>>>> >>>>>> No. >>>>>> >>>>>>> >>>>>>> We have an enterprise policy so that administrators can keep the >>>>>>>> existing behavior. We're planning to remove the policy on Chrome 103. >>>>>>>> 2: >>>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>>> ByWildcard >>>>>>>> >>>>>>>> >>>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>>> thread. >>>>>>>> >>>>>>>> WebKit: Positive Apple showed a positive signal in a private >>>>>>>> thread. >>>>>>>> >>>>>>>> Web developers: No signals >>>>>>>> >>>>>>>> >>>>>>>> Debuggability >>>>>>>> >>>>>>>> We'll show a CORS error to the devtools console. >>>>>>>> >>>>>>>> >>>>>>>> Is this feature fully tested by web-platform-tests >>>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>>> ?Yes >>>>>>>> >>>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>>> >>>>>>>> Requires code in //chrome?False (or, True only for the enterprise >>>>>>>> policy.) >>>>>>>> >>>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>>> >>>>>>>> Estimated milestones >>>>>>>> >>>>>>>> 97 >>>>>>>> >>>>>>>> Link to entry on the Chrome Platform Status >>>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>>> >>>>>>>> -- >>>>>>>> You received this message because you are subscribed to the Google >>>>>>>> Groups "blink-dev" group. >>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>> send an email to [email protected]. >>>>>>>> To view this discussion on the web visit >>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>> . >>>>>>>> >>>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "blink-dev" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to [email protected]. >>>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>> -- >>> You received this message because you are subscribed to the Google >>> Groups "blink-dev" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> >> To view this discussion on the web visit >>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>> . >>> >> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6HeWcU%2BxwFJooV4NCRF5xjK_zt9YTqP6GqjbW_nPWQWig%40mail.gmail.com.
