Add client-hints clearing support #74

arichiv · 2023-06-28T15:22:33Z

We should be sure to cover this too for a new specific option, as well as the existing cookie and cache cases.

This is required by w3c/webappsec-clear-site-data#74

bikeshed -f spec ./index.src.htm

This is required by w3c/webappsec-clear-site-data#74

Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a

Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a

mikewest

Definition looks reasonable enough. I'm curious about why we'd separate this kind of cache out from cache or storage? The other options we currently have are fairly broad (storage vs. indexed-db/localstorage/etc); do you have thoughts about a guideline we could follow that would help us land on the right level of granularity?

arichiv · 2023-06-30T08:51:37Z

That’s a good point, I’m not sure I have a hard and fast line to adhere to. This situation feels unique since the only way to clear the CH cache is via a header already, but the existing method (an empty Accept-CH header) was against the spec for an sf-list and would fail if a second header of the same type was sent. There likely may be a reason to clear the cache or cookies at the same time that the ch cache is cleared, but because we already had a targeted way to clear it the granularity felt reasonable.

Another option would be to just clear the ch cache on cache or cookie clears, and not add a granular target. Instead someone could send Accept-CH: clear. This would be compliant with the sf-list spec and even if other headers of the same type are sent we could just roll up the values, notice the clear token, and ignore all but it. @miketaylr @yoavweiss for comment

The main issue with that approach is that it’s incompatible with the older clear method and the user agent is being frozen so the site wouldn’t know which to use.

Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a

Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4652839 Reviewed-by: Avi Drissman <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#1165947}

…-Data method, a=testonly Automatic update from web-platform-tests [Client Hints] Support custom Clear-Site-Data method Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4652839 Reviewed-by: Avi Drissman <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#1165947} -- wpt-commits: fc5bb604a77419e6bdcd0f52a072713c04385cfb wpt-pr: 40815

Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c

mikewest

LGTM % nits.

index.src.html

Co-authored-by: Mike West <[email protected]>

…-Data method, a=testonly Automatic update from web-platform-tests [Client Hints] Support custom Clear-Site-Data method Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4652839 Reviewed-by: Avi Drissman <avichromium.org> Commit-Queue: Avi Drissman <avichromium.org> Auto-Submit: Ari Chivukula <arichivchromium.org> Reviewed-by: Arthur Sonzogni <arthursonzognichromium.org> Cr-Commit-Position: refs/heads/main{#1165947} -- wpt-commits: fc5bb604a77419e6bdcd0f52a072713c04385cfb wpt-pr: 40815 UltraBlame original commit: d3360fa0d016dc45ffdad7991fb0c779a704d08c

…-Data method, a=testonly Automatic update from web-platform-tests [Client Hints] Support custom Clear-Site-Data method Let's add a (disabled by default) method to target just client hints for clearing. This is per the proposed spec change: w3c/webappsec-clear-site-data#74 Note: The next step is to ensure that the Clear-Site-Data directive causes any Accept-CH or Critical-CH to be ignored when it does clear client hints. Bug: 1458394 Change-Id: Iae52b86d68bd6c0f81a9886c6ee29b7245d6915a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4652839 Reviewed-by: Avi Drissman <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#1165947} -- wpt-commits: fc5bb604a77419e6bdcd0f52a072713c04385cfb wpt-pr: 40815

Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c

…tical-CH headers Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c

…tical-CH headers Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4683467 Reviewed-by: Avi Drissman <[email protected]> Reviewed-by: Maks Orlovich <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1174862}

… overwrites Accept-CH and Critical-CH headers, a=testonly Automatic update from web-platform-tests [Clear-Site-Data] Ensure Clear-Site-Data overwrites Accept-CH and Critical-CH headers Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4683467 Reviewed-by: Avi Drissman <[email protected]> Reviewed-by: Maks Orlovich <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1174862} -- wpt-commits: 80842019ed0a351468da763704ca45b04a17103c wpt-pr: 41019

…tical-CH headers Per the spec: w3c/webappsec-clear-site-data#74 We must not store new client hints if we are already clearing them. Bug: 1458394 Change-Id: Ie82e60175784de52b6a3ac7756af31949c89df0c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4683467 Reviewed-by: Avi Drissman <[email protected]> Reviewed-by: Maks Orlovich <[email protected]> Auto-Submit: Ari Chivukula <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1174862}

Add client-hints clearing support

3c26a16

We should be sure to cover this too for a new specific option, as well as the existing cookie and cache cases.

arichiv requested a review from mikewest June 28, 2023 15:22

arichiv self-assigned this Jun 28, 2023

arichiv added a commit to WICG/client-hints-infrastructure that referenced this pull request Jun 28, 2023

Export Accept-CH Cache

3f89c17

This is required by w3c/webappsec-clear-site-data#74

arichiv mentioned this pull request Jun 28, 2023

Export Accept-CH Cache WICG/client-hints-infrastructure#156

Merged

pip install bikeshed && bikeshed update

d2344aa

bikeshed -f spec ./index.src.htm

miketaylr pushed a commit to WICG/client-hints-infrastructure that referenced this pull request Jun 29, 2023

Export Accept-CH Cache (#156)

c9d66e8

This is required by w3c/webappsec-clear-site-data#74

Update index.src.html

c0ac352

chromium-wpt-export-bot mentioned this pull request Jun 29, 2023

[Client Hints] Support custom Clear-Site-Data method web-platform-tests/wpt#40815

Merged

mikewest reviewed Jun 30, 2023

View reviewed changes

arichiv mentioned this pull request Jul 6, 2023

Empty Accept-CH being used to clear Client Hint requests WICG/client-hints-infrastructure#155

Closed

arichiv requested a review from mikewest July 6, 2023 17:30

arichiv mentioned this pull request Jul 7, 2023

Support for clearing Client Hints in Clear-Site-Data header w3c/webappsec#628

Open

chromium-wpt-export-bot mentioned this pull request Jul 13, 2023

[Clear-Site-Data] Ensure Clear-Site-Data overwrites Accept-CH and Critical-CH headers web-platform-tests/wpt#41019

Merged

mikewest approved these changes Jul 14, 2023

View reviewed changes

index.src.html Show resolved Hide resolved

index.src.html Outdated Show resolved Hide resolved

arichiv and others added 2 commits July 14, 2023 08:01

Update index.src.html

d29a231

Co-authored-by: Mike West <[email protected]>

build

9f71037

arichiv merged commit f331dc0 into main Jul 14, 2023

arichiv deleted the arichiv-patch-1 branch July 14, 2023 12:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add client-hints clearing support #74

Add client-hints clearing support #74

arichiv commented Jun 28, 2023 •

edited by pr-preview bot

Loading

mikewest left a comment

arichiv commented Jun 30, 2023 •

edited

Loading

mikewest left a comment

Add client-hints clearing support #74

Add client-hints clearing support #74

Conversation

arichiv commented Jun 28, 2023 • edited by pr-preview bot Loading

mikewest left a comment

Choose a reason for hiding this comment

arichiv commented Jun 30, 2023 • edited Loading

mikewest left a comment

Choose a reason for hiding this comment

arichiv commented Jun 28, 2023 •

edited by pr-preview bot

Loading

arichiv commented Jun 30, 2023 •

edited

Loading