Cross-origin fetches - HTTP 203

Do you know your cookies from your CSRF from your CORS from your CORB from your CORP from your COEP? In this episode, Jake and Surma dive into the world of cross-origin fetches, and how the web is still battling against some early design mistakes.
Details on the SameSite rollback → blog.chromium....
Other videos in the series → goo.gle/2wneQLl
Subscribe to Google Chrome Developers here → goo.gle/Chrome...
Also, if you enjoyed this, you might like the HTTP203 podcast! → goo.gle/2y0I5Uo
Whoa, thanks for reading the description right to the end! Did you spot the secret message in this episode? There isn't one, but why not tell folks in the comments that you spotted it?

[@lele_l]

Http 203 is easily one of my favourite shows on KZbin :D

[@nonlogos]

I need a 3 hr deep dive video on this

[@wmhilton-old]

I was with you up until CORP and then I got lost 😂. I'll have to rewatch and pause it.

[@wmhilton-old]

Alright, got it!

[@brentgreeff1115]

Is it my imagination or has this vid been sped up by 10% or so?

[@jakearchibald]

Nah, we just talk a bit too fast

[@brentgreeff1115]

@@jakearchibald - I bet 10 Google Bucks its sped up = interesting vid though.

[@jakearchibald]

​@@brentgreeff1115​ you just lost 10 Google Bucks

[@driziiD]

when are we going to give these guys their golden globe award

[@CyberAcidPlanet]

I liked the plot progression in this episode, especially the reveal in the end. Felt like some super villain was defeated!

[@driziiD]

thank you for explaining CORS. I can finally stop having recurring nightmares about it. my therapist will be pleased.

[@MaxCoplan]

This was a fantastic episode. I learned a bunch, and now I want more! You should make a bonus episode with all the "boring" details you cut out

[@Zolbat]

The big try catch block to figure out the correct string to use depending on the version of browser the user has, really reminds me of iOS these days with all the switches depending on what kind of notch phone you have

[@mustafwm]

Thanks guys Just one request: If you can assume a bit less knowledge from us next time, that'd be great :) Some of those concepts/examples seemed a bit advanced and were just glanced over, it would have been more helpful if they were explained a bit more. Thanks again :) Looking forward to the tracking episode

[@jakearchibald]

This is really good feedback, thanks. What kinds of things could have done with more detail? The first half of this episode ran longer than I intended, so I think I rushed the rest, sorry!

[@mustafwm]

@@jakearchibald Thanks for your reply. Actually it's first section that I wish it had more explanation .. those mistakes/risks of current cookies implementation... how sending someone to some form on your website can result in you reading their cookies and causing damage? having an onLoad event on avatar image load? what's potentially being leaked? how's sending the Origin header with POST can prevent that? PS: I really enjoyed the episode, and have learned a lot from you guys here & on twitter (don't mean to be critical here). Thanks :)

[@TheNewton]

​@@jakearchibald With CORS's problems&solutions growing more mazelike, I'm not sure the discussion format alone can demystify it. I think it it has to be vid&handson maybe a walkthrough setup and pentest showing the problem, and not just a subtopic of other things like lab-fetch-api it's own focused lab on webfundamentals( or websecurityfundamentals even) .

[@taskforce_kerim]

@@jakearchibald I think a more detailed explanation or examples of a bad situation would be good. For example, many times it's not exactly clear which site is the evil site. Is it example.com or the site fetching from example.com? If i t's the site fetching from example.com, how can it read the cookie content of example.com? Can site A intercept the get request to site B?

[@IanJamesPhotography]

Waited 23 minutes for the dog promised by the video thumbnail. Worth it.

[@flightvision]

+1 for a whole episode about unwanted information sharing (tracking) ("Sad User" ;) ). Your topics are always very interesting it is just hard to follow along sometimes as a non-native speaker.

[@DenisTRUFFAUT]

Web workers gonna love Cross-Origin-Embedder-Policy !

[@honmameiko1333]

Glad to know the sameSite policy change has been resumed😂

[@finally_code]

Well, this turned into a reality show quickly ...

[@googleplexer]

«got me notes» - it’s awesome 😎 😂

[@nivoset]

Especially with micro front ends coming up. Something needs to be worked out

[@nobodyz2700]

yeah... 2020 is pretty bad for breaking changes...

[@joshkramer2435]

Already subscribed, but Watson got me to click the bell!

[@jcestibariz]

Some reference material: CORP: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy CORB: www.chromium.org/Home/chromium-security/corb-for-developers nosniff: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options COEP: wicg.github.io/cross-origin-embedder-policy/

[@TheNewton]

1:50 pdfs, may be a competitor since mosaic could display them but AFAIK that may only been while on the file path so maybe not a pure sub resource except in however they programmed it to display in a html browser, and ummm actually there was no tag in the spec which probably also rules out any stylesheet prototypes.

[@jakearchibald]

Yeah, I don't think it was a subresource, just a top-level navigation.

[@maistho]

That's a lovely dog :)

[@ancientelevator9]

I feel like you should have introduced the class of problems at the beginning, as well as a walkthrough of some examples.

[@Dygear]

CORB-on-the-COB.

[@kyay10]

Can you make a video explaining what Meltdown and Spectre is and how it worked and stuff like that? Cuz y'all keep mentioning it, and it honestly sounds pretty interesting!

[@jakearchibald]

kzbin.info/www/bejne/mnPYqp6omc1-Y6M might do the trick

[@MaxCoplan]

@@jakearchibald When will I get my precious SharedArrayBuffers back in all the major browsers 😫? Shoutouts to Chrome at least for getting them back asap, but hard to invest a lot in them without support from WebKit. Cheers

[@danilaplee]

omg this is such a hot topic!!!

[@shobhitchittora2267]

Eye opening!

[@albertodeagostini6143]

You should show Watson more often

[@davidmaxwaterman]

What about the problem with losing the cookies (eg sessionid) when your app is added to homescreen on iOS, where your index.html has been cached by the service worker...and/or you're now offline? It works in-browser, but not from homescreen.

[@danielni]

So we should still implement CSRF tokens until all browsers support SameSite=Lax?

[@jakearchibald]

If you're targeting browsers that don't support SameSite, then yes, you'll need an alternative. The Origin header can be simpler than tokens, but again it depends on browser support. Also, this stuff doesn't work if you have GET endpoints that perform actions, but y'know, you shouldn't have those.

[@frutiboy1]

This was hard to learn much from it :,-)

[@CardinalHijack]

Hey Jake, I find it super interesting at 1:35 where you said you were not allowed on the internet, and "nobody knew what the internet was". So I wonder how you got into it? You often find that industry leaders like yourself started coding on a PC when they were around 9 (not that its necessary, but you tend to notice early introduction to tech), so I found it interesting that you seem to state the opposite.

[@jakearchibald]

I tinkered around with bits of BASIC when I was 7 I guess, but I was more interested in graphical design & animation until I was in my late teens

[@CardinalHijack]

Jake Archibald interesting. Thanks for the reply

[@duncan-dean]

Wow nice secret in description.

[@joshuvageorge1678]

what is subresource? :

[@Cookie_Wookie_7]

When is the cross sure tracking episode

[@jakearchibald]

Oh yeah, we haven't done this yet (although I've mentioned parts of it in other talks), although there's blog.google/products/ads-commerce/a-more-privacy-first-web if you want to know the latest

[@vengateshvaidyanathang550]

Guys please provide a gist of entire code at the final minutes..

[@hobbyturystaSEO]

what about cors at firebase ?

[@eduardoreis8500]

Would you share that presentation?

[@DavidElstob73]

Guys, is it actually possible to Server Push self-hosted fonts? When I add crossorigin my push degrades to a preload. It's super annoying and I can't find a solution. You are my last hope. :)

[@jakearchibald]

You might be being tripped up by jakearchibald.com/2017/h2-push-tougher-than-i-thought/#requests-without-credentials-use-a-separate-connection. Server push is generally bad.

[@davidmaxwaterman]

I had to unsubscribe in order to subscribe....ditto for the bell.

[@gettingthingsdone]

caring about privacy on the web. working at Google. :D

[@aham3687]

Tongue twister