We've been showing a deprecation message since 94 <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071>. Sadly the deprecation message hasn't decreased the usage so far.
On Thu, Dec 9, 2021 at 1:52 AM Mike West <[email protected]> wrote: > From my perspective, it's a bit worrying that you found user-visible > breakage in a random sampling of the otherwise small number of sites that > fall into this category. As Yoav suggested, there's some additional > likelihood that we're not seeing some breakage that requires sign-in. It > might be worthwhile to raise a deprecation warning for this behavior, and > remove it after giving developers some time to adjust, perhaps with an > enterprise policy for good measure. I'd be happy with a 3-release timeline, > with removal thereafter. That might drive the usage down to the point where > we can reasonably remove it. If it doesn't, we might need to do some more > research (wiring this counter up to UKM, for instance) to see if we can > track down more clear sources of potential breakage. > > -mike > > On Thursday, December 2, 2021 at 6:56:40 AM UTC+1 Yutaka Hirano wrote: > >> On Thu, Dec 2, 2021 at 12:29 AM Yoav Weiss <[email protected]> >> wrote: >> >>> >>> >>> On Wed, Dec 1, 2021 at 4:00 PM Yutaka Hirano <[email protected]> >>> wrote: >>> >>>> Sorry for the delay! >>>> >>>> I checked 10 sites. I saw console errors in three sites among them: >>>> 1. https://cchatty.com/ >>>> 2. https://techrxiv.org/ >>>> 3. https://bodyshake.com/ >>>> >>>> I only see a visible breakage in 1 (cards in the main panel are >>>> invisible). On other sites I don't see any visible differences. >>>> Please note that this feature is related to authorization so it is >>>> likely to break things when signing in. >>>> >>> >>> So it's possible that the breakage only occurs for logged in users, and >>> is not something you'd be able to see when spot checking their homepage? >>> >>> >> Yeah, I think so. >> >> >> >>> >>>> >>>> On Wed, Dec 1, 2021 at 8:11 PM Yoav Weiss <[email protected]> >>>> wrote: >>>> >>>>> Friendly ping on Chris' question >>>>> >>>>> On Thursday, November 4, 2021 at 8:31:36 PM UTC+1 Chris Harrelson >>>>> wrote: >>>>> >>>>>> Would it be feasible to get a random list of 10-20 sites that hit the >>>>>> use counter and see if they are broken badly by this feature? >>>>>> >>>>>> On Thu, Nov 4, 2021 at 4:54 AM Yutaka Hirano <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> (friendly ping) >>>>>>> >>>>>>> On Mon, Nov 1, 2021 at 1:57 PM Yutaka Hirano <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> Thank you for the feedback. >>>>>>>> >>>>>>>> Do you have concrete steps for the investigation in your mind? >>>>>>>> >>>>>>>> On Fri, Oct 29, 2021 at 4:30 AM Mike West <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>>> I think it's reasonable for us to dig into the data a little bit >>>>>>>>> to determine whether the 0.04% number quoted above will result in >>>>>>>>> user-facing breakage. Yutaka, is that something you'd be willing to >>>>>>>>> dig >>>>>>>>> into? >>>>>>>>> >>>>>>>>> The direction seems philosophically correct to me, so I'd like to >>>>>>>>> see it ship, but I'd also like to make sure we're not making the web >>>>>>>>> worse >>>>>>>>> for users by doing so. >>>>>>>>> >>>>>>>>> -mike >>>>>>>>> >>>>>>>>> >>>>>>>>> On Thu, Oct 21, 2021 at 12:04 PM Yutaka Hirano < >>>>>>>>> [email protected]> wrote: >>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Thu, Oct 21, 2021 at 6:25 PM Yoav Weiss < >>>>>>>>>> [email protected]> wrote: >>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Thu, Oct 21, 2021 at 9:55 AM Yutaka Hirano < >>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>> >>>>>>>>>>>> (The implementation CL >>>>>>>>>>>> <https://chromium-review.googlesource.com/c/chromium/src/+/3226283> >>>>>>>>>>>> is under review. This intent is written as if it's landed.) >>>>>>>>>>>> >>>>>>>>>>>> Contact [email protected] >>>>>>>>>>>> >>>>>>>>>>>> Specification >>>>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>>>> >>>>>>>>>>>> Summary >>>>>>>>>>>> >>>>>>>>>>>> A CORS non-wildcard request header[1] is an HTTP request header >>>>>>>>>>>> which is not covered by the wildcard symbol ("*") in the >>>>>>>>>>>> access-control-allow-headers header. "authorization" is the only >>>>>>>>>>>> member of >>>>>>>>>>>> CORS non-wildcard request-header. Currently we treat the header as >>>>>>>>>>>> a usual >>>>>>>>>>>> header, which is problematic for security reasons. Implement it, >>>>>>>>>>>> and change >>>>>>>>>>>> the current behavior. 1: >>>>>>>>>>>> https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Blink componentBlink>SecurityFeature>CORS >>>>>>>>>>>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3ESecurityFeature%3ECORS> >>>>>>>>>>>> >>>>>>>>>>>> TAG reviewNot needed because this implements an existing >>>>>>>>>>>> feature. >>>>>>>>>>>> >>>>>>>>>>>> TAG review statusNot applicable >>>>>>>>>>>> >>>>>>>>>>>> Risks >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Interoperability and Compatibility >>>>>>>>>>>> >>>>>>>>>>>> Interoperability risk is low because Mozilla and Apple showed >>>>>>>>>>>> an intent to implement this behavior. There is some compatibility >>>>>>>>>>>> risk, as >>>>>>>>>>>> the use counter[2] shows 0.04% websites would be affected. To >>>>>>>>>>>> mitigate the >>>>>>>>>>>> risk, we've shown a deprecation message for a few milestones. >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Can you similarly send deprecation reports as well? How long >>>>>>>>>>> have the deprecation messages been in place? Did we see any decline >>>>>>>>>>> in the >>>>>>>>>>> numbers? >>>>>>>>>>> >>>>>>>>>>> We've shown the deprecation message since Chrome 94 >>>>>>>>>> <https://chromiumdash.appspot.com/commit/9a817d69a132822ddf2954120e96a3efa2290071> >>>>>>>>>> whose >>>>>>>>>> beta promotion was on Aug 26 and stable release was on Sep 21. >>>>>>>>>> We use CountDeprecation which sends deprecation reports >>>>>>>>>> automatically IIUC. >>>>>>>>>> >>>>>>>>>> I don't see any decline. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> Have we looked into which URLs are triggering this? (and if it's >>>>>>>>>>> a few medium-sized properties or many tiny ones) >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I haven't looked at the data. >>>>>>>>>> >>>>>>>>>>> Did we try outreach? >>>>>>>>>>> >>>>>>>>>> No. >>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> We have an enterprise policy so that administrators can keep the >>>>>>>>>>>> existing behavior. We're planning to remove the policy on Chrome >>>>>>>>>>>> 103. 2: >>>>>>>>>>>> https://www.chromestatus.com/metrics/feature/popularity#AuthorizationCovered >>>>>>>>>>>> ByWildcard >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Gecko: Positive Firefox showed a positive signal in a private >>>>>>>>>>>> thread. >>>>>>>>>>>> >>>>>>>>>>>> WebKit: Positive Apple showed a positive signal in a private >>>>>>>>>>>> thread. >>>>>>>>>>>> >>>>>>>>>>>> Web developers: No signals >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Debuggability >>>>>>>>>>>> >>>>>>>>>>>> We'll show a CORS error to the devtools console. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Is this feature fully tested by web-platform-tests >>>>>>>>>>>> <https://chromium.googlesource.com/chromium/src/+/master/docs/testing/web_platform_tests.md> >>>>>>>>>>>> ?Yes >>>>>>>>>>>> >>>>>>>>>>>> Flag nameCorsNonWildcardRequestHeadersSupport >>>>>>>>>>>> >>>>>>>>>>>> Requires code in //chrome?False (or, True only for the >>>>>>>>>>>> enterprise policy.) >>>>>>>>>>>> >>>>>>>>>>>> Tracking bughttps://crbug.com/1176753 >>>>>>>>>>>> >>>>>>>>>>>> Estimated milestones >>>>>>>>>>>> >>>>>>>>>>>> 97 >>>>>>>>>>>> >>>>>>>>>>>> Link to entry on the Chrome Platform Status >>>>>>>>>>>> https://chromestatus.com/feature/5742041264816128 >>>>>>>>>>>> >>>>>>>>>>>> -- >>>>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>>>> Google Groups "blink-dev" group. >>>>>>>>>>>> To unsubscribe from this group and stop receiving emails from >>>>>>>>>>>> it, send an email to [email protected]. >>>>>>>>>>>> To view this discussion on the web visit >>>>>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com >>>>>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6G2mzUAH_Ghrqmb1xM7XetfKgB%3DMUkX0DED7yWbL4JfGg%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>>>>> . >>>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>> Google Groups "blink-dev" group. >>>>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>>>> send an email to [email protected]. >>>>>>>>>> To view this discussion on the web visit >>>>>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com >>>>>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6GB-CbbCqx0VHa7%3DLoZr%2BZN-O7o7XwTGkxXEYQa9OfupQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>>>>> . >>>>>>>>>> >>>>>>>>> -- >>>>>>> You received this message because you are subscribed to the Google >>>>>>> Groups "blink-dev" group. >>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>> send an email to [email protected]. >>>>>>> >>>>>> To view this discussion on the web visit >>>>>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com >>>>>>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6EqkidJF3mjfnztmMnKrEpb%3DPTvW-kpW0s_bWCM%3DOXY8A%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>>>> . >>>>>>> >>>>>> -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CABihn6FFmQqpDtYZcvHUcLDpYf1LBq_gx%2BvaVoLmvW8tXTb2EQ%40mail.gmail.com.
