| 04:12 | <MikeSmith> | botie, inform a-ja I added scope/updateviacache/workertype support to the checker sources and pushed to https://checker.html5.org/ & https://validator.w3.org/nu/ I also added some filtering for now to suppress the warning about child-src |
| 04:12 | <botie> | will do |
| 07:07 | <annevk> | domfarolino: sounds like you didn't leave your sense of logic at the door |
| 07:19 | <MikeSmith> | annevk: if/when you have time please read https://stackoverflow.com/questions/45004354/when-should-i-really-set-access-control-allow-credentials-to-true-in-my-resp/45005539#45005539 and either comment to correct anything I might have gotten wrong there, or else post another answer (and I can delete mine) |
| 07:20 | MikeSmith | steps away for a while pick up the master of the house from daycare |
| 07:35 | <annevk> | MikeSmith: added a minor comment |
| 07:35 | <annevk> | MikeSmith: master of the house, hah, that escalated quickly |
| 08:58 | <MikeSmith> | annevk: :) “There can be only one” ... I’m Ramirez and he’s the younger guy |
| 08:58 | <MikeSmith> | (and thanks for the comment and reviewing the answer) |
| 09:33 | <domfarolino> | annevk: True lol. Gonna chime in on (https://github.com/whatwg/html/issues/1679) in the morning. I would like to help clean up the section if necessary, a little confused about a couple things regarding the algorithm |
| 10:40 | <annevk> | JakeA: how does canceling and no-cors interact? |
| 10:40 | <annevk> | JakeA: can you create a partial response body that way? |
| 10:40 | <annevk> | JakeA: I think there's an issue on that somewhere |
| 10:41 | <JakeA> | annevk: hmm yeah, I guess it's something to point the security folks at. I mean, you'd have a stream that definitely errored, and probably related violations in terms of content-length |
| 10:42 | <JakeA> | I'd expect a script element to not-execute if the content stream errored |
| 10:42 | <annevk> | JakeA: yeah, it's related to the old content-length issue |
| 10:42 | <JakeA> | but I guess that's worth investigating |
| 10:42 | <JakeA> | annevk: the tests I wrote expect no-cors cancelling to "work", but it is new |
| 10:43 | <annevk> | JakeA: https://github.com/tc39/proposal-cancelable-promises/issues/4 |
| 10:43 | <annevk> | JakeA: yeah, your tests reminded me |
| 10:50 | <annevk> | JakeA: what's the best way to track the no-cors issue? Should I just open it as a new issue against Fetch that we link from all the various places? |
| 10:51 | <JakeA> | annevk: Yeah, and I'll email our security folks and get them involved |
| 10:53 | <annevk> | JakeA: I noticed btw that we have a similar "how to design canceling" problem with HTML's navigate algorithm |
| 10:53 | <annevk> | JakeA: it's rather vague and hand-wavy |
| 10:54 | <annevk> | JakeA: XHR has some state stuff, but also not great |
| 10:54 | <JakeA> | annevk: I've been using XHR to validate my tests to some extent, and there's a few weird race conditions which I guess is the result of hand-waving in the spec |
| 10:59 | <JakeA> | annevk: actually, this email I'm writing would make a good intro to the issue, so if you haven't started already, I can create the issue |
| 10:59 | <annevk> | JakeA: I PM'd you my notes |
| 11:00 | <annevk> | JakeA: feel free to finish |
| 11:02 | <annevk> | JakeA: so I think what you said about <script> and erred streams makes sense |
| 11:02 | <annevk> | JakeA: the problem would be with streaming stuff |
| 11:02 | <annevk> | JakeA: e.g., CSS that gets applied incrementally (is that a thing?) |
| 11:03 | <JakeA> | it isn't a thing |
| 11:03 | <JakeA> | but HTML parsing |
| 11:03 | <annevk> | JakeA: we have incremental HTML rendering, but that's already required to be non-opaque |
| 11:03 | <JakeA> | annevk: there's img, video, audio |
| 11:03 | <annevk> | JakeA: well, do we want to prevent incremental CSS? |
| 11:04 | <annevk> | JakeA: those are good examples too |
| 11:04 | <JakeA> | annevk: I think streaming CSS would result in a lot of shifting around during page load |
| 11:04 | <annevk> | JakeA: I'm guessing if we don't want to make things worse we'd just not error streams |
| 11:04 | <JakeA> | Eg .hide-this {…} at the end of the CSS resource |
| 11:05 | <annevk> | JakeA: we could still error the request though, but once you have the whole response header, no more canceling |
| 11:05 | <annevk> | JakeA: even if layout isn't done yet, should the CSSOM be allocated all at once? |
| 11:06 | <JakeA> | annevk: that's an interesting question. I thought it'd be all at once. |
| 11:06 | <JakeA> | But I guess I have no reason to think that |
| 11:07 | <JakeA> | I thought the CSSOM would represent actionable CSS |
| 11:07 | <annevk> | The spec doesn't really say it either way I think |
| 12:18 | <annevk> | JakeA: fetch/api/abort/general.js contains the majority of tests, right? |
| 12:18 | <JakeA> | annevk: yeah |
| 12:20 | <jochen__> | annevk: re html issue 2792 - I don't get your comment? |
| 12:21 | <annevk> | jochen__: can cookies be shared across ports, can WebAuthn be shared across ports? |
| 12:21 | <jochen__> | document.domain is a script only feature, no? |
| 12:21 | <annevk> | jochen__: it builds upon a shared primitive |
| 12:22 | <jochen__> | i'm not sure I agree |
| 12:22 | <annevk> | You don't agree with the specs? |
| 12:23 | <jochen__> | now that there's something shared in how document.domain and cookies work |
| 12:23 | <jochen__> | s/now/no,/ |
| 12:23 | <annevk> | JakeA: "() => log.push(`${bodyMethod}-resolve`)" any reason that's not assert_unreached? |
| 12:24 | <annevk> | jochen__: cookies share in a very similar way, they just don't have the opt-in switch |
| 12:25 | <JakeA> | annevk: assert_unreached seems like a more standard way. Will push a change now |
| 12:29 | <jochen__> | annevk: webauthn tries to match cookies, and explicitly states that that's different from what same-origin domain means :/ |
| 12:30 | <annevk> | jochen__: WebAuthn integrates with HTML directly |
| 12:30 | <annevk> | jochen__: that refactoring landed earlier this year |
| 12:30 | <annevk> | jochen__: and unless you can tell me how cookies are different, I think you might be missing something |
| 12:32 | <annevk> | jochen__: see https://bugzilla.mozilla.org/show_bug.cgi?id=1329764 for such refactoring making its way into Fx |
| 12:34 | <jochen__> | annevk: in webauthn, a token's scope is the relying parties origin, or any registratable domain suffix |
| 12:35 | <jochen__> | annevk: for document.domain, you have to decide for one domain, suffixes won't match |
| 12:36 | <annevk> | jochen__: what do you mean with having to decide for one domain, suffixes won't match? |
| 12:36 | <jochen__> | if I want to access another iframe |
| 12:36 | <jochen__> | my document.domain has to be the same as the other iframe's document.domain |
| 12:37 | <jochen__> | if I want to access a token |
| 12:37 | <jochen__> | my document.domain has to be the same or any suffix of the token's domain |
| 12:37 | <annevk> | it's about what document.domain can be set to |
| 12:37 | <annevk> | what's the reach it gives you |
| 12:37 | <annevk> | that's the shared primitive |
| 12:38 | <jochen__> | I see |
| 12:39 | <jochen__> | then I think the reach is too broad if it ignores the port |
| 12:39 | <annevk> | that's fair and I'm wondering if we also want to make that decision for Webauthn and cookies then |
| 12:39 | <annevk> | as there ports are also not considered |
| 12:40 | <jochen__> | cookies have a ton of options |
| 12:40 | <annevk> | or if we want to fork the shared primitive somehow |
| 12:40 | <jochen__> | I could imagine to add a kind of cookies that is only usable via default ports |
| 12:40 | <annevk> | to make cookies and Webauthn similar you'd just restrict them to the same port |
| 12:41 | <jochen__> | well, basically, if you're on a non-default port, I don't care, as long as you don't match default ports |
| 12:41 | <annevk> | Cookies additionally ignore scheme, I guess for document.domain that's no longer an issue because of mixed content blocking |
| 12:42 | <annevk> | And I guess/hope Webauthn requires HTTPS too? |
| 12:42 | <annevk> | Anyway, all I meant to say with my comment is that I want them considered together, since they all have the same kind of leak |
| 12:43 | <annevk> | If we only patch one, that should be a conscious decision |
| 12:46 | <jochen__> | yes, it's https only |
| 12:46 | <jochen__> | ok, makes sense. Thx for clarifying :) |
| 15:15 | <gsnedders> | JakeA: damnit, can't better .310s |
| 15:16 | <JakeA> | gsnedders: I wonder if it differs from device to device. I can't better .200, but some people are claiming 0.01 |
| 15:16 | <JakeA> | They might be liars :D |
| 15:17 | <gsnedders> | JakeA: Are you sure they aren't Valtteri's throwaways? |
| 15:17 | <JakeA> | haha |
| 15:18 | <gsnedders> | I'm pretty consistently around 0.330s |
| 15:19 | <gsnedders> | But really clicking is easy, no coordination between hands and feet needed |
| 15:20 | <gsnedders> | Anyhow, yes, work. |
| 17:08 | <Domenic> | annevk: I realize I woke up too late to make this a realistic ping, but ping on writing tests for https://github.com/whatwg/html/issues/2753#issuecomment-311753445 |