| 00:35 | <MikeSmith> | dmarr: fetch just sends back whatever cookies are set for that domain, right? |
| 00:37 | <dmarr> | MikeSmith: I think so. I have a call to my api which challenges the user with the Basic Auth creds, and then subsequent requests send in the Authentication request header. I'm trying to understand the hooks there |
| 01:35 | <MikeSmith> | dmarr: to be clear, you know credentials: 'include' doesn’t affect the sending of the Authentication header? |
| 01:35 | <MikeSmith> | and I guess you probably mean Authorization header? |
| 01:36 | <MikeSmith> | anyway, I wonder what actual error you’re running into |
| 01:36 | <MikeSmith> | is the server not receiving cookies that you think it should be? |
| 03:18 | <MikeSmith> | https://webkit.org/blog/7877/release-notes-for-safari-technology-preview-38/ |
| 03:18 | <MikeSmith> | > Enabled Payment Requests as an experimental feature |
| 03:19 | <MikeSmith> | nice |
| 03:20 | <MikeSmith> | ... though I guess it might cause people to get their hopes up a little bit higher than intended |
| 03:21 | <MikeSmith> | since so far what they landed seems to be literally just the experimental-feature flag for it, but not the actual API |
| 03:21 | <MikeSmith> | anyway, progress |
| 03:51 | <TimothyGu> | anyone got thoughts on https://github.com/nodejs/node/issues/14994? basically, a user wants to go to a domain with xn--a--a in it, but some Node.js internal issue caused a replacement character to be added because that domain isn't valid Punycode. |
| 03:53 | <TimothyGu> | after https://github.com/whatwg/url/pull/309#issuecomment-301414556 the URL Standard decided to call ToASCII on all domains (including pure ASCII ones), and throw on invalid Punycode-encoded URLs, but I'm not sure if that's the best solution here, as the user (fairly) assumed pure ASCII input would not get transformed in any way |
| 03:54 | <TimothyGu> | annevk: ^^ |
| 06:45 | <annevk> | TimothyGu: why would the user assume that? |
| 06:45 | <TimothyGu> | well, the name "ToASCII" kind of means "transform a domain to ASCII" |
| 06:46 | <annevk> | TimothyGu: ToASCII is an implementation detail of IDNA |
| 06:46 | <annevk> | TimothyGu: not exposed to users |
| 06:47 | <annevk> | TimothyGu: anyway, the xn--a--a is an interesting case, this is an internal domain that works, maybe even on some browsers? |
| 06:47 | <TimothyGu> | Chrome at least doesn't throw an error |
| 06:47 | <annevk> | TimothyGu: Fx probably doesn't either |
| 06:48 | <annevk> | TimothyGu: so even with ignore hyphens we still hit compat issues because of these rather weird domain names |
| 06:48 | <TimothyGu> | yeah |
| 06:48 | <annevk> | sigh |
| 06:48 | <annevk> | And Node gets bitten because browsers haven't fixed stuff yet |
| 06:49 | <annevk> | The idea behind applying ToASCII to ASCII input is that the a-z character set shouldn't get special treatment over other character sets |
| 06:50 | <annevk> | However, actual compat issues probably might trump that, depending on severity and willingness of browsers to do the right thing anyway |
| 06:58 | <TimothyGu> | annevk: would you mind explaining that in the issue? |
| 07:03 | <annevk> | TimothyGu: the node one? I guess I can in a bit |
| 07:03 | <TimothyGu> | yeah |
| 07:11 | <annevk> | done |
| 07:24 | <TimothyGu> | thanks! |
| 07:48 | <tobie> | TimothyGu: sorry for the back and forth on that small PR of yours. I can fix myself before merging if you prefer. |
| 07:49 | <TimothyGu> | tobie: sure, go ahead! |
| 07:52 | <tobie> | zcorpan: well, making [Exposed] explicit certainly has some benefits given https://github.com/w3c/css-houdini-drafts/pull/464! |
| 08:30 | <zcorpan> | FYI https://wiki.whatwg.org/index.php?title=What_you_can_do&diff=10184&oldid=10178 |
| 11:53 | <xfq> | zcorpan: the [GitHub repositories] link doesn't work |
| 11:53 | <xfq> | (since it's Wikitext, instead of Markdown) |
| 11:54 | <zcorpan> | xfq: thanks. danged wikitext |
| 13:20 | <annevk> | GPHemsley: you around? We're moving a bunch of stuff away from DreamHost and were wondering if you could help with the wiki |
| 13:21 | <annevk> | GPHemsley: if you can, foolip can give you server access and such |
| 14:07 | <wanderview> | annevk: about the integrity bug where you said "its reasonable to not do anything"... you mean don't throw a TypeError and then check the integrity? Or ignore the integrity check then? |
| 14:15 | <wanderview> | annevk: I went ahead and filed a spec issue: https://github.com/whatwg/fetch/issues/583 |
| 14:32 | <annevk> | wanderview: sorry for being vague :/ I meant not throwing |
| 14:47 | <wanderview> | annevk: I think the spec is good about ignoring the integrity value on opaque responses... but we don't have a check for it on implementation side |
| 14:48 | <wanderview> | so I think we could probably just do that |
| 14:49 | <annevk> | wanderview: it doesn't ignore it |
| 14:49 | <annevk> | wanderview: it results in a network error |
| 14:49 | <wanderview> | annevk: the SRI spec does\ |
| 14:49 | <annevk> | wanderview: hmm |
| 14:50 | <wanderview> | annevk: are you saying fetch throws network error because it looks at the body instead of unfiltered body? and the opaque body is filtered to be empty? |
| 14:50 | <wanderview> | I guess it has a note to that effect |
| 14:51 | <annevk> | wanderview: "If ... response does not match request’s integrity metadata, set response and internalResponse to a network error" |
| 14:51 | <annevk> | wanderview: it doesn't match for an opaque response |
| 14:51 | <annevk> | wanderview: match is https://w3c.github.io/webappsec-subresource-integrity/#does-response-match-metadatalist |
| 14:51 | <wanderview> | annevk: the SRI spec has text suggesting if a <script integrity> results in a cross-origin no-cors, then integrity should be ignored |
| 14:51 | <annevk> | o_O |
| 14:52 | <wanderview> | oh, maybe I misunderstood that bit |
| 14:52 | <annevk> | That's not what I thought we had agreement on, but I haven't studied SRI in detail |
| 14:52 | <wanderview> | annevk: I think you are right |
| 14:52 | <annevk> | I thought it mostly deferred to Fetch at this point |
| 14:52 | <wanderview> | I misread it |
| 14:57 | <wanderview> | annevk: I wonder if it would be ok to reject immediately with network error when we go opaque and there is an integrity value... instead of computing hashes, etc |
| 14:57 | <wanderview> | or waiting for body to complete |
| 15:04 | <annevk> | wanderview: there'll be a timing difference but that should be okay |
| 15:05 | <annevk> | wanderview: maybe should be clarified though as currently it reads like it's not okay |
| 15:05 | <wanderview> | annevk: I think we will read to end and then evaluate against empty string |
| 15:06 | <wanderview> | annevk: also, I don't think there are any fetch integrity tests against no-cors |
| 15:06 | <wanderview> | AFAICT |
| 15:07 | <wanderview> | annevk: I'm going to see if tt has time to look at this... he wrote our fetch integrity support initially |
| 15:14 | <annevk> | wanderview: sounds good |
| 19:14 | <tantek> | saw this and wondered what folks here thought about the concept and general approach of a map/geo element to natively display a map on a page: https://shkspr.mobi/blog/2017/08/mapping-in-html-a-proposal-for-a-new-element/ |
| 19:50 | <tobie> | tantek: why not offer as a custom element (at least as a first step)? |
| 19:51 | <tantek> | tobie, agreed! |
| 19:52 | <tantek> | might be an interesting / complex enough real world example to really exercise the capabilities of web components |
| 19:52 | <tobie> | TabAtkins: could bikeshed somehow allow templating the advisement here: https://heycam.github.io/webidl/#LegacyArrayClass, it's used on a number of extended attributes. |
| 19:53 | <tobie> | tantek: yes, and there are high-level JS API requirements for navigation on top of it. |
| 20:18 | <tantek> | looks like the tweet thread links to a few custom element attempts https://twitter.com/edent/status/900677910998155265 |
| 20:53 | <TabAtkins> | tobie: You can use a <pre class=include> element https://tabatkins.github.io/bikeshed/#including |
| 20:56 | <tobie> | TabAtkins: I can't have those inline, can I? (cake + eat it too) |
| 20:56 | <TabAtkins> | Hmm, not right now, but open an issue on me. I'd have to do something different for the macros, is all. |
| 20:57 | <tobie> | TabAtkins: as attributes? |
| 20:58 | <TabAtkins> | I'll figure it out. |
| 21:05 | <tobie> | TabAtkins: awesome. Thanks. https://github.com/tabatkins/bikeshed/issues/1078 |
| 21:05 | <TabAtkins> | (Not gonna hit it immediately, I'm in the middle of making `bikeshed update` only download what's changed.) |
| 21:58 | <tobie> | TabAtkins: no hurry. (And as far as I'm concerned, https://github.com/tabatkins/bikeshed/issues/1077 is higher up in my list of priorities.) |