>From my perspective, it's a bit worrying that you found user-visible breakage in a random sampling of the otherwise small number of sites that fall into this category. As Yoav suggested, there's some additional likelihood that we're not seeing some breakage that requires sign-in. It might be worthwhile to raise a deprecation warning for this behavior, and remove it after giving developers some time to adjust, perhaps with an enterprise policy for good measure. I'd be happy with a 3-release timeline, with removal thereafter. That might drive the usage down to the point where we can reasonably remove it. If it doesn't, we might need to do some more research (wiring this counter up to UKM, for instance) to see if we can track down more clear sources of potential breakage.
-mike On Thursday, December 2, 2021 at 6:56:40 AM UTC+1 Yutaka Hirano wrote: > On Thu, Dec 2, 2021 at 12:29 AM Yoav Weiss <[email protected]> wrote: > >> >> >> On Wed, Dec 1, 2021 at 4:00 PM Yutaka Hirano <[email protected]> >> wrote: >> >>> Sorry for the delay! >>> >>> I checked 10 sites. I saw console errors in three sites among them: >>> 1. https://cchatty.com/ >>> 2. https://techrxiv.org/ >>> 3. https://bodyshake.com/ >>> >>> I only see a visible breakage in 1 (cards in the main panel are >>> invisible). On other sites I don't see any visible differences. >>> Please note that this feature is related to authorization so it is >>> likely to break things when signing in. >>> >> >> So it's possible that the breakage only occurs for logged in users, and >> is not something you'd be able to see when spot checking their homepage? >> >> > Yeah, I think so. > > > >> >>> >>> On Wed, Dec 1, 2021 at 8:11 PM Yoav Weiss <[email protected]> >>> wrote: >>> >>>> Friendly ping on Chris' question >>>> >>>> On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson wrote: >>>> >>>>> Would it be feasible to get a random list of 10-20 sites that hit the >>>>> use counter and see if they are broken badly by this feature? >>>>> >>>>> On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> >>>>> wrote: >>>>> >>>>>> (friendly ping) >>>>>> >>>>>> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> Thank you for the feedback. >>>>>>> >>>>>>> Do you have concrete steps for the investigation in your mind? >>>>>>> >>>>>>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> I think it's reasonable for us to dig into the data a little bit to >>>>>>>> determine whether the 0.04% number quoted above will result in >>>>>>>> user-facing >>>>>>>> breakage. Yutaka, is that something you'd be willing to dig into? >>>>>>>> >>>>>>>> The direction seems philosophically correct to me, so I'd like to >>>>>>>> see it ship, but I'd also like to make sure we're not making the web >>>>>>>> worse >>>>>>>> for users by doing so. >>>>>>>> >>>>>>>> -mike >>>>>>>> >>>>>>>> >>>>>>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano < >>>>>>>> [email protected]> wrote: >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss <[email protected]> >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano < >>>>>>>>>> [email protected]> wrote: >>>>>>>>>> >>>>>>>>>>> (The implementation CL >>>>>>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>>>>>> is under review. This intent is written as if it's landed.) >>>>>>>>>>> >>>>>>>>>>> Contact [email protected] >>>>>>>>>>> >>>>>>>>>>> Specification >>>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>>> >>>>>>>>>>> Summary >>>>>>>>>>> >>>>>>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>>>>>> access-control-allow-headers header. "authorization" is the only >>>>>>>>>>> member of >>>>>>>>>>> CORS non-wildcard request-header. Currently we treat the header as >>>>>>>>>>> a usual >>>>>>>>>>> header, which is problematic for security reasons. Implement it, >>>>>>>>>>> and change >>>>>>>>>>> the current behavior. 1: >>>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>>>>>> >>>>>>>>>>> TAG reviewNot needed because this implements an existing >>>>>>>>>>> feature. >>>>>>>>>>> >>>>>>>>>>> TAG review statusNot applicable >>>>>>>>>>> >>>>>>>>>>> Risks >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Interoperability and Compatibility >>>>>>>>>>> >>>>>>>>>>> Interoperability risk is low because Mozilla and Apple showed an >>>>>>>>>>> intent to implement this behavior. There is some compatibility >>>>>>>>>>> risk, as the >>>>>>>>>>> use counter[2] shows 0.04% websites would be affected. To mitigate >>>>>>>>>>> the >>>>>>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Can you similarly send deprecation reports as well? How long have >>>>>>>>>> the deprecation messages been in place? Did we see any decline in >>>>>>>>>> the >>>>>>>>>> numbers? >>>>>>>>>> >>>>>>>>>> We've shown the deprecation message since Chrome 94 >>>>>>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>>>>>> whose >>>>>>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>>>>>> We use CountDeprecation which sends deprecation reports >>>>>>>>> automatically IIUC. >>>>>>>>> >>>>>>>>> I don't see any decline. >>>>>>>>> >>>>>>>>> >>>>>>>>>> Have we looked into which URLs are triggering this? (and if it's >>>>>>>>>> a few medium-sized properties or many tiny ones) >>>>>>>>>> >>>>>>>>> >>>>>>>>> I haven't looked at the data. >>>>>>>>> >>>>>>>>>> Did we try outreach? >>>>>>>>>> >>>>>>>>> No. >>>>>>>>> >>>>>>>>>> >>>>>>>>>> We have an enterprise policy so that administrators can keep the >>>>>>>>>>> existing behavior. We're planning to remove the policy on Chrome >>>>>>>>>>> 103. 2: >>>>>>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>>>>>> ByWildcard >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>>>>>> thread. >>>>>>>>>>> >>>>>>>>>>> WebKit: Positive Apple showed a positive signal in a private >>>>>>>>>>> thread. >>>>>>>>>>> >>>>>>>>>>> Web developers: No signals >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Debuggability >>>>>>>>>>> >>>>>>>>>>> We'll show a CORS error to the devtools console. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Is this feature fully tested by web-platform-tests >>>>>>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>>>>>> ?Yes >>>>>>>>>>> >>>>>>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>>>>>> >>>>>>>>>>> Requires code in //chrome?False (or, True only for the >>>>>>>>>>> enterprise policy.) >>>>>>>>>>> >>>>>>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>>>>>> >>>>>>>>>>> Estimated milestones >>>>>>>>>>> >>>>>>>>>>> 97 >>>>>>>>>>> >>>>>>>>>>> Link to entry on the Chrome Platform Status >>>>>>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>>> Google Groups "blink-dev" group. >>>>>>>>>>> To unsubscribe from this group and stop receiving emails from >>>>>>>>>>> it, send an email to [email protected]. >>>>>>>>>>> To view this discussion on the web visit >>>>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>>>>>> >>>>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>>>> . >>>>>>>>>>> >>>>>>>>>> -- >>>>>>>>> You received this message because you are subscribed to the Google >>>>>>>>> Groups "blink-dev" group. >>>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>>> send an email to [email protected]. >>>>>>>>> To view this discussion on the web visit >>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>>>>>> >>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>> . >>>>>>>>> >>>>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "blink-dev" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to [email protected]. >>>>>> >>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >>>>>> >>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/b1cd6004-3942-4c84-a5c1-24026f8a1f2cn%40chromium.org.
