Cross-origin fetches - HTTP 203

[@lele_l]

Http 203 is easily one of my favourite shows on KZbin :D

[@nonlogos]

I need a 3 hr deep dive video on this

[@driziiD]

when are we going to give these guys their golden globe award

[@wmhilton-old]

I was with you up until CORP and then I got lost 😂. I'll have to rewatch and pause it.

[@wmhilton-old]

Alright, got it!

[@brentgreeff1115]

Is it my imagination or has this vid been sped up by 10% or so?

[@jakearchibald]

Nah, we just talk a bit too fast

[@brentgreeff1115]

@@jakearchibald - I bet 10 Google Bucks its sped up = interesting vid though.

[@jakearchibald]

​@@brentgreeff1115​ you just lost 10 Google Bucks

[@driziiD]

thank you for explaining CORS. I can finally stop having recurring nightmares about it. my therapist will be pleased.

[@MaxCoplan]

This was a fantastic episode. I learned a bunch, and now I want more! You should make a bonus episode with all the "boring" details you cut out

[@CyberAcidPlanet]

I liked the plot progression in this episode, especially the reveal in the end. Felt like some super villain was defeated!

[@IanJamesPhotography]

Waited 23 minutes for the dog promised by the video thumbnail. Worth it.

[@Zolbat]

The big try catch block to figure out the correct string to use depending on the version of browser the user has, really reminds me of iOS these days with all the switches depending on what kind of notch phone you have

[@jcestibariz]

Some reference material: CORP: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy CORB: www.chromium.org/Home/chromium-security/corb-for-developers nosniff: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options COEP: wicg.github.io/cross-origin-embedder-policy/

[@mustafwm]

Thanks guys Just one request: If you can assume a bit less knowledge from us next time, that'd be great :) Some of those concepts/examples seemed a bit advanced and were just glanced over, it would have been more helpful if they were explained a bit more. Thanks again :) Looking forward to the tracking episode

[@jakearchibald]

This is really good feedback, thanks. What kinds of things could have done with more detail? The first half of this episode ran longer than I intended, so I think I rushed the rest, sorry!

[@mustafwm]

@@jakearchibald Thanks for your reply. Actually it's first section that I wish it had more explanation .. those mistakes/risks of current cookies implementation... how sending someone to some form on your website can result in you reading their cookies and causing damage? having an onLoad event on avatar image load? what's potentially being leaked? how's sending the Origin header with POST can prevent that? PS: I really enjoyed the episode, and have learned a lot from you guys here & on twitter (don't mean to be critical here). Thanks :)

[@TheNewton]

​@@jakearchibald With CORS's problems&solutions growing more mazelike, I'm not sure the discussion format alone can demystify it. I think it it has to be vid&handson maybe a walkthrough setup and pentest showing the problem, and not just a subtopic of other things like lab-fetch-api it's own focused lab on webfundamentals( or websecurityfundamentals even) .

[@taskforce_kerim]

@@jakearchibald I think a more detailed explanation or examples of a bad situation would be good. For example, many times it's not exactly clear which site is the evil site. Is it example.com or the site fetching from example.com? If i t's the site fetching from example.com, how can it read the cookie content of example.com? Can site A intercept the get request to site B?

[@DenisTRUFFAUT]

Web workers gonna love Cross-Origin-Embedder-Policy !

[@honmameiko1333]

Glad to know the sameSite policy change has been resumed😂

[@flightvision]

+1 for a whole episode about unwanted information sharing (tracking) ("Sad User" ;) ). Your topics are always very interesting it is just hard to follow along sometimes as a non-native speaker.

[@ancientelevator9]

I feel like you should have introduced the class of problems at the beginning, as well as a walkthrough of some examples.

[@TheNewton]

1:50 pdfs, may be a competitor since mosaic could display them but AFAIK that may only been while on the file path so maybe not a pure sub resource except in however they programmed it to display in a html browser, and ummm actually there was no tag in the spec which probably also rules out any stylesheet prototypes.

[@jakearchibald]

Yeah, I don't think it was a subresource, just a top-level navigation.

[@davidmaxwaterman]

What about the problem with losing the cookies (eg sessionid) when your app is added to homescreen on iOS, where your index.html has been cached by the service worker...and/or you're now offline? It works in-browser, but not from homescreen.

[@Cookie_Wookie_7]

When is the cross sure tracking episode

[@jakearchibald]

Oh yeah, we haven't done this yet (although I've mentioned parts of it in other talks), although there's blog.google/products/ads-commerce/a-more-privacy-first-web if you want to know the latest

[@nivoset]

Especially with micro front ends coming up. Something needs to be worked out

[@vengateshvaidyanathang550]

Guys please provide a gist of entire code at the final minutes..

[@nobodyz2700]

yeah... 2020 is pretty bad for breaking changes...

[@hobbyturystaSEO]

what about cors at firebase ?

[@eduardoreis8500]

Would you share that presentation?

[@api-first]

Well, this turned into a reality show quickly ...

[@joshuvageorge1678]

what is subresource? :

[@danielni]

So we should still implement CSRF tokens until all browsers support SameSite=Lax?

[@jakearchibald]

If you're targeting browsers that don't support SameSite, then yes, you'll need an alternative. The Origin header can be simpler than tokens, but again it depends on browser support. Also, this stuff doesn't work if you have GET endpoints that perform actions, but y'know, you shouldn't have those.

[@kyay10]

Can you make a video explaining what Meltdown and Spectre is and how it worked and stuff like that? Cuz y'all keep mentioning it, and it honestly sounds pretty interesting!

[@jakearchibald]

kzbin.info/www/bejne/mnPYqp6omc1-Y6M might do the trick

[@MaxCoplan]

@@jakearchibald When will I get my precious SharedArrayBuffers back in all the major browsers 😫? Shoutouts to Chrome at least for getting them back asap, but hard to invest a lot in them without support from WebKit. Cheers

[@googleplexer]

«got me notes» - it’s awesome 😎 😂

[@joshkramer2435]

Already subscribed, but Watson got me to click the bell!

[@albertodeagostini6143]

You should show Watson more often

[@CardinalHijack]

Hey Jake, I find it super interesting at 1:35 where you said you were not allowed on the internet, and "nobody knew what the internet was". So I wonder how you got into it? You often find that industry leaders like yourself started coding on a PC when they were around 9 (not that its necessary, but you tend to notice early introduction to tech), so I found it interesting that you seem to state the opposite.

[@jakearchibald]

I tinkered around with bits of BASIC when I was 7 I guess, but I was more interested in graphical design & animation until I was in my late teens

[@CardinalHijack]

Jake Archibald interesting. Thanks for the reply

[@Dygear]

CORB-on-the-COB.

[@DavidElstob73]

Guys, is it actually possible to Server Push self-hosted fonts? When I add crossorigin my push degrades to a preload. It's super annoying and I can't find a solution. You are my last hope. :)

[@jakearchibald]

You might be being tripped up by jakearchibald.com/2017/h2-push-tougher-than-i-thought/#requests-without-credentials-use-a-separate-connection. Server push is generally bad.

[@danilaplee]

omg this is such a hot topic!!!

[@maistho]

That's a lovely dog :)

[@frutiboy1]

This was hard to learn much from it :,-)

[@shobhitchittora2267]

Eye opening!

[@duncan-dean]

Wow nice secret in description.

[@gettingthingsdone]

caring about privacy on the web. working at Google. :D

[@davidmaxwaterman]

I had to unsubscribe in order to subscribe....ditto for the bell.

[@aham3687]

Tongue twister