On Thu, Dec 2, 2021 at 12:29 AM Yoav Weiss <[email protected]> wrote:
> > > On Wed, Dec 1, 2021 at 4:00 PM Yutaka Hirano <[email protected]> wrote: > >> Sorry for the delay! >> >> I checked 10 sites. I saw console errors in three sites among them: >> 1. https://cchatty.com/ >> 2. https://techrxiv.org/ >> 3. https://bodyshake.com/ >> >> I only see a visible breakage in 1 (cards in the main panel are >> invisible). On other sites I don't see any visible differences. >> Please note that this feature is related to authorization so it is likely >> to break things when signing in. >> > > So it's possible that the breakage only occurs for logged in users, and is > not something you'd be able to see when spot checking their homepage? > > Yeah, I think so. > >> >> On Wed, Dec 1, 2021 at 8:11 PM Yoav Weiss <[email protected]> wrote: >> >>> Friendly ping on Chris' question >>> >>> On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson wrote: >>> >>>> Would it be feasible to get a random list of 10-20 sites that hit the >>>> use counter and see if they are broken badly by this feature? >>>> >>>> On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> >>>> wrote: >>>> >>>>> (friendly ping) >>>>> >>>>> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >>>>> wrote: >>>>> >>>>>> Thank you for the feedback. >>>>>> >>>>>> Do you have concrete steps for the investigation in your mind? >>>>>> >>>>>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> wrote: >>>>>> >>>>>>> I think it's reasonable for us to dig into the data a little bit to >>>>>>> determine whether the 0.04% number quoted above will result in >>>>>>> user-facing >>>>>>> breakage. Yutaka, is that something you'd be willing to dig into? >>>>>>> >>>>>>> The direction seems philosophically correct to me, so I'd like to >>>>>>> see it ship, but I'd also like to make sure we're not making the web >>>>>>> worse >>>>>>> for users by doing so. >>>>>>> >>>>>>> -mike >>>>>>> >>>>>>> >>>>>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano < >>>>>>>>> [email protected]> wrote: >>>>>>>>> >>>>>>>>>> (The implementation CL >>>>>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>>>>> is under review. This intent is written as if it's landed.) >>>>>>>>>> >>>>>>>>>> Contact [email protected] >>>>>>>>>> >>>>>>>>>> Specification >>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>> >>>>>>>>>> Summary >>>>>>>>>> >>>>>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>>>>> access-control-allow-headers header. "authorization" is the only >>>>>>>>>> member of >>>>>>>>>> CORS non-wildcard request-header. Currently we treat the header as a >>>>>>>>>> usual >>>>>>>>>> header, which is problematic for security reasons. Implement it, and >>>>>>>>>> change >>>>>>>>>> the current behavior. 1: >>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>>>>> >>>>>>>>>> TAG reviewNot needed because this implements an existing feature. >>>>>>>>>> >>>>>>>>>> TAG review statusNot applicable >>>>>>>>>> >>>>>>>>>> Risks >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Interoperability and Compatibility >>>>>>>>>> >>>>>>>>>> Interoperability risk is low because Mozilla and Apple showed an >>>>>>>>>> intent to implement this behavior. There is some compatibility risk, >>>>>>>>>> as the >>>>>>>>>> use counter[2] shows 0.04% websites would be affected. To mitigate >>>>>>>>>> the >>>>>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>>>>> >>>>>>>>> >>>>>>>>> Can you similarly send deprecation reports as well? How long have >>>>>>>>> the deprecation messages been in place? Did we see any decline in the >>>>>>>>> numbers? >>>>>>>>> >>>>>>>>> We've shown the deprecation message since Chrome 94 >>>>>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>>>>> whose >>>>>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>>>>> We use CountDeprecation which sends deprecation reports >>>>>>>> automatically IIUC. >>>>>>>> >>>>>>>> I don't see any decline. >>>>>>>> >>>>>>>> >>>>>>>>> Have we looked into which URLs are triggering this? (and if it's a >>>>>>>>> few medium-sized properties or many tiny ones) >>>>>>>>> >>>>>>>> >>>>>>>> I haven't looked at the data. >>>>>>>> >>>>>>>>> Did we try outreach? >>>>>>>>> >>>>>>>> No. >>>>>>>> >>>>>>>>> >>>>>>>>> We have an enterprise policy so that administrators can keep the >>>>>>>>>> existing behavior. We're planning to remove the policy on Chrome >>>>>>>>>> 103. 2: >>>>>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>>>>> ByWildcard >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>>>>> thread. >>>>>>>>>> >>>>>>>>>> WebKit: Positive Apple showed a positive signal in a private >>>>>>>>>> thread. >>>>>>>>>> >>>>>>>>>> Web developers: No signals >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Debuggability >>>>>>>>>> >>>>>>>>>> We'll show a CORS error to the devtools console. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Is this feature fully tested by web-platform-tests >>>>>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>>>>> ?Yes >>>>>>>>>> >>>>>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>>>>> >>>>>>>>>> Requires code in //chrome?False (or, True only for the >>>>>>>>>> enterprise policy.) >>>>>>>>>> >>>>>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>>>>> >>>>>>>>>> Estimated milestones >>>>>>>>>> >>>>>>>>>> 97 >>>>>>>>>> >>>>>>>>>> Link to entry on the Chrome Platform Status >>>>>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>> Google Groups "blink-dev" group. >>>>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>>>> send an email to [email protected]. >>>>>>>>>> To view this discussion on the web visit >>>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>>> . >>>>>>>>>> >>>>>>>>> -- >>>>>>>> You received this message because you are subscribed to the Google >>>>>>>> Groups "blink-dev" group. >>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>> send an email to [email protected]. >>>>>>>> To view this discussion on the web visit >>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>> . >>>>>>>> >>>>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "blink-dev" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected]. >>>>> >>>> To view this discussion on the web visit >>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> >>>> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6Gbd-3jd-oBg%2By5rHwrJ2PXut_aQheU%2BgWpgtHD4xn4sg%40mail.gmail.com.
