On Wed, Dec 1, 2021 at 4:00 PM Yutaka Hirano <[email protected]> wrote:
> Sorry for the delay! > > I checked 10 sites. I saw console errors in three sites among them: > 1. https://cchatty.com/ > 2. https://techrxiv.org/ > 3. https://bodyshake.com/ > > I only see a visible breakage in 1 (cards in the main panel are > invisible). On other sites I don't see any visible differences. > Please note that this feature is related to authorization so it is likely > to break things when signing in. > So it's possible that the breakage only occurs for logged in users, and is not something you'd be able to see when spot checking their homepage? > > > On Wed, Dec 1, 2021 at 8:11 PM Yoav Weiss <[email protected]> wrote: > >> Friendly ping on Chris' question >> >> On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson wrote: >> >>> Would it be feasible to get a random list of 10-20 sites that hit the >>> use counter and see if they are broken badly by this feature? >>> >>> On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> >>> wrote: >>> >>>> (friendly ping) >>>> >>>> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >>>> wrote: >>>> >>>>> Thank you for the feedback. >>>>> >>>>> Do you have concrete steps for the investigation in your mind? >>>>> >>>>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> wrote: >>>>> >>>>>> I think it's reasonable for us to dig into the data a little bit to >>>>>> determine whether the 0.04% number quoted above will result in >>>>>> user-facing >>>>>> breakage. Yutaka, is that something you'd be willing to dig into? >>>>>> >>>>>> The direction seems philosophically correct to me, so I'd like to see >>>>>> it ship, but I'd also like to make sure we're not making the web worse >>>>>> for >>>>>> users by doing so. >>>>>> >>>>>> -mike >>>>>> >>>>>> >>>>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> >>>>>>> >>>>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>>> (The implementation CL >>>>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>>>> is under review. This intent is written as if it's landed.) >>>>>>>>> >>>>>>>>> Contact [email protected] >>>>>>>>> >>>>>>>>> Specification >>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>> >>>>>>>>> Summary >>>>>>>>> >>>>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>>>> access-control-allow-headers header. "authorization" is the only >>>>>>>>> member of >>>>>>>>> CORS non-wildcard request-header. Currently we treat the header as a >>>>>>>>> usual >>>>>>>>> header, which is problematic for security reasons. Implement it, and >>>>>>>>> change >>>>>>>>> the current behavior. 1: >>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>> >>>>>>>>> >>>>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>>>> >>>>>>>>> TAG reviewNot needed because this implements an existing feature. >>>>>>>>> >>>>>>>>> TAG review statusNot applicable >>>>>>>>> >>>>>>>>> Risks >>>>>>>>> >>>>>>>>> >>>>>>>>> Interoperability and Compatibility >>>>>>>>> >>>>>>>>> Interoperability risk is low because Mozilla and Apple showed an >>>>>>>>> intent to implement this behavior. There is some compatibility risk, >>>>>>>>> as the >>>>>>>>> use counter[2] shows 0.04% websites would be affected. To mitigate the >>>>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>>>> >>>>>>>> >>>>>>>> Can you similarly send deprecation reports as well? How long have >>>>>>>> the deprecation messages been in place? Did we see any decline in the >>>>>>>> numbers? >>>>>>>> >>>>>>>> We've shown the deprecation message since Chrome 94 >>>>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>>>> whose >>>>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>>>> We use CountDeprecation which sends deprecation reports >>>>>>> automatically IIUC. >>>>>>> >>>>>>> I don't see any decline. >>>>>>> >>>>>>> >>>>>>>> Have we looked into which URLs are triggering this? (and if it's a >>>>>>>> few medium-sized properties or many tiny ones) >>>>>>>> >>>>>>> >>>>>>> I haven't looked at the data. >>>>>>> >>>>>>>> Did we try outreach? >>>>>>>> >>>>>>> No. >>>>>>> >>>>>>>> >>>>>>>> We have an enterprise policy so that administrators can keep the >>>>>>>>> existing behavior. We're planning to remove the policy on Chrome 103. >>>>>>>>> 2: >>>>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>>>> ByWildcard >>>>>>>>> >>>>>>>>> >>>>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>>>> thread. >>>>>>>>> >>>>>>>>> WebKit: Positive Apple showed a positive signal in a private >>>>>>>>> thread. >>>>>>>>> >>>>>>>>> Web developers: No signals >>>>>>>>> >>>>>>>>> >>>>>>>>> Debuggability >>>>>>>>> >>>>>>>>> We'll show a CORS error to the devtools console. >>>>>>>>> >>>>>>>>> >>>>>>>>> Is this feature fully tested by web-platform-tests >>>>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>>>> ?Yes >>>>>>>>> >>>>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>>>> >>>>>>>>> Requires code in //chrome?False (or, True only for the enterprise >>>>>>>>> policy.) >>>>>>>>> >>>>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>>>> >>>>>>>>> Estimated milestones >>>>>>>>> >>>>>>>>> 97 >>>>>>>>> >>>>>>>>> Link to entry on the Chrome Platform Status >>>>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>>>> >>>>>>>>> -- >>>>>>>>> You received this message because you are subscribed to the Google >>>>>>>>> Groups "blink-dev" group. >>>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>>> send an email to [email protected]. >>>>>>>>> To view this discussion on the web visit >>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>> . >>>>>>>>> >>>>>>>> -- >>>>>>> You received this message because you are subscribed to the Google >>>>>>> Groups "blink-dev" group. >>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>> send an email to [email protected]. >>>>>>> To view this discussion on the web visit >>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>> . >>>>>>> >>>>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "blink-dev" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> >>> To view this discussion on the web visit >>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>> . >>>> >>> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAL5BFfWpixadj6kmshY1N4yTfS1GUkAcD36_nB3%2BfV8mngbk2A%40mail.gmail.com.
