Define the ACHL cache and ACHL/ACH processing #3774

yoavweiss · 2018-06-26T05:05:22Z

This PR replaces whatwg/fetch#729 in resolving whatwg/fetch#726, which as discussed should move to HTML. Rough design sketch is also available.

This initial PR still doesn't resolve everything that was previously discussed (e.g. doesn't clear the ACHL cache along with cookies just yet), but I'd love to get an early opinion on it, to see if this is the right direction.

💥 Error: Wattsi server error 💥

PR Preview failed to build. (Last tried on Jan 15, 2021, 7:58 AM UTC).

More

PR Preview relies on a number of web services to run. There seems to be an issue with the following one:

🚨 Wattsi Server - Wattsi Server is the web service used to build the WHATWG HTML spec.

🔗 Related URL

Command failed: /home/noderunner/wattsi/bin/wattsi /tmp/upload_0ec8aad0092002ba014c8379c796379a (sha not provided) xb60amlrcof default /tmp/upload_4af09a62e949c52e570fb6968177e318

If you don't have enough information above to solve the error by yourself (or to understand to which web service the error is related to, if any), please file an issue.

domenic

Lots of editorial things, and one big model confusion.

source

domenic · 2018-06-26T18:21:04Z

source

+  <li><dfn data-x="concept-accept-ch-lifetime-cache-max-age"
+  data-definition-for="concept-accept-ch-lifetime-cache">max-age</dfn> (a number of seconds)</li>
+  <li><dfn data-x="concept-accept-ch-lifetime-cache-client-hints-list"
+  data-definition-for="concept-accept-ch-lifetime-cache">client-hints-list</dfn></li>


"(a list of X)" would be good

I thought it should match (or eventually replace) https://fetch.spec.whatwg.org/#client-hints-list

Oh interesting. Then it should probably be "(a client hints list)" which links to that definition. Although, that definition might be best changed to a set, not a list.

source

domenic · 2018-06-26T18:37:07Z

source

+     settings object a secure context?</span> on the <code>Window</code> object's
+     environment settings object.</p></li>
+
+     <li><p>If <var>response</var>'s


This model seems kind of broken.

What is a settings object's clients hints list? It's obtained by the algorithm "retrieve client-hints list", which creates a new list each time it's called. So, appending to it has no effect.

You seem to have mixed together two models which contradict each other:

Client hints list is figured out from preexisting data ("retrieve client-hints list" figures out some subset of the Accept-CH lifetime cache that applies)

Client hints list gets modified directly during Document creation

So the model I had in mind is:

Accept-CH adds client hints to the current env settings object's client-hints list.

After that, an Accept-CH-lifetime header stores entries in the ACHL cache, based on the current env settings object.

When an env settings object is created, it's initial client-hints list is populated from the cache.

"retrieve client hints list" indeed creates a new list, but then populates it with of all cached hints from the cache (as there could be multiple entries which may correspond the current origin, with different hints on each.)

Does that make sense?

yoavweiss · 2018-06-27T08:40:29Z

@domenic - thanks for reviewing! :) I addressed most of your comments, and left TODOs for the rest, which I intend to tackle a bit later (but before landing)

domenic · 2018-06-27T15:29:15Z

(Continuing this discussion away from now-collapsed commit comments:)

So the model I had in mind is:

Accept-CH adds client hints to the current env settings object's client-hints list.

After that, an Accept-CH-lifetime header stores entries in the ACHL cache, based on the current env settings object.

When an env settings object is created, it's initial client-hints list is populated from the cache.

"retrieve client hints list" indeed creates a new list, but then populates it with of all cached hints from the cache (as there could be multiple entries which may correspond the current origin, with different hints on each.)

Does that make sense?

It could make sense, but as written doesn't really work. Every time you say "some settings object's client-hints set", you run the algorithm specified in https://whatpr.org/html/3774/window-object.html#script-settings-for-window-objects , which re-creates a new list from scratch. So any additions you make to it (via Accept-CH) are only to that list, and are never seen again by any future callers of "some settings object's client-hints set".

If you want a single list that's created once, and then stored and returned later, you need to explicitly do that.

Relatedly, it seems a bit strange that you intend to create one client hints set per environment settings object (<-> Window), whereas all the other similar stuff like origin, HTTPS state, and referrer policy are associated with the Document. The main difference here is how you treat the transition from initial about:blank to a new Document within the same window. As written right now, if I add <meta> elements to the initial about:blank, then navigate to https://example.com/, the client hints that were set by those <meta> elements in about:blank will still apply to https://example.com/. That doesn't seem right to me?

I'd thus suggest a framework that more closely follows referrer policy or HTTPS state:

Documents and WorkerGlobalScope instances get a client hints set, initially empty. (This is the only time we ever create client hints sets.)
The environment settings object algorithms return that set. (The purpose of this is to provide a small indirection so that fetch only ever has to worry about clients = environment settings objects, not about Documents vs. WorkerGlobalScopes vs. ...)

Then I think this would work:

When creating a document or workerglobalscope, "retrieve the client hints set" for the correct origin, and then loop over the result and append them to the document/WGS's client hints set.
Accept-CH adds client hints to the Document/WGS's client hints set. (This now works, because running the "get client hints set" algorithm doesn't return a fresh set each time anymore, so mutating it has the desired effect.)

Thoughts?

yoavweiss · 2018-06-28T14:29:23Z

@domenic makes perfect sense! Working on changing the model. Will be ready for re-review tomorrow.

yoavweiss · 2018-06-28T22:03:09Z

@domenic technically, it's tomorrow for me :D I think I fixed all the comments. Can you PTAL?

I still need to update the corresponding Fetch PR, to rename its client hints list to client hints set

yoavweiss · 2018-06-28T22:22:40Z

source

@@ -97614,6 +97877,14 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {

     </dd>

+     <dt>The <span data-x="concept-settings-object-client-hints-set">client-hints set</span></dt>


@domenic - I'm not sure this is what you meant by proxying the WGS's client-hints set through the settings object's client-hints set. Would that work?

domenic · 2018-07-02T21:16:15Z

OK, I did a pass through for a final review that was mostly editorial. Please check my changes and let me know what you think.

I'd still prefer to hold off on this until @annevk has time to look at it from a higher conceptual/architectural. But, I think it's pretty solid at the level that I can understand.

All good now

yoavweiss

@domenic - Thanks for the fix-ups!

yoavweiss · 2018-07-03T04:35:07Z

source

-  given <var>origin</var>, <var>max-age</var>, and <var>client-hints set</var>,
-  add a new entry with the following fields to the Accept-CH-Lifetime cache:
+  <p>To <dfn>add a new Accept-CH-Lifetime cache entry</dfn> to the <span
+  data-x="concept-accept-ch-lifetime-cache">Accept-CH-Lifetime cache</span>, given


Oops, changed the name here, but missed changing the link and the callers. Thanks for fixing!

yoavweiss · 2018-07-03T04:46:05Z

@domenic - Thanks for reviewing and fixing up. Your changes look good from my perspective. Waiting for @annevk to land the PRs makes sense.

annevk

Looks good overall, I think, but lots of tiny issues remain as far as I can tell.

source

annevk · 2018-08-13T13:27:15Z

source

+
+    <ol>
+     <li><p>If the <code>meta</code> element is not a child of a <code>head</code> element, then
+     return.</p></li>


Shouldn't this be more strict so it only works for head element that is the first element child of the root element? What do implementations do here? Do we test the difference?

Copied that piece from CSP. Maybe worth while to coalesce that logic into a single place. I don't think current tests make sure this (or CSP) only work for a head element that's the first child of root

annevk · 2018-08-13T13:28:00Z

source

+     <code data-x="attr-meta-content">content</code> attribute's value.</p></li>
+
+     <li><p>Parse <var>acceptCHValue</var> according to the `<code>Accept-CH</code>` header parsing
+     rules, as a <span data-x="concept-http-field-name">field-name</span>. Append each parsed


Isn't it a field value?

It's defined as field-name at https://httpwg.org/http-extensions/client-hints.html#accept-ch
That makes sense as the values accepted are request header names

So it's defined as a sequence of field-names, but that doesn't seem conveyed here? In particular the # is significant.

source

Only notable thing is using the formal "same origin" concept, and some precision improvements in the meta elements.

igrigorik mentioned this pull request Jun 26, 2018

Integrate latest Client Hints updates whatwg/fetch#726

Closed

10 tasks

This was referenced Jun 26, 2018

Align CH processing model with implementation and HTML#3774 whatwg/fetch#773

Closed

Add Accept-CH-lifetime cache and CH header handling whatwg/fetch#729

Closed

domenic previously requested changes Jun 26, 2018

View reviewed changes

yoavweiss commented Jun 28, 2018

View reviewed changes

yoavweiss commented Jul 3, 2018

View reviewed changes

annevk reviewed Aug 13, 2018

View reviewed changes

yoavweiss mentioned this pull request Oct 1, 2018

Check Feature Policy before attaching Client Hints whatwg/fetch#811

Closed

eeeps mentioned this pull request Dec 14, 2018

Define policy-controlled features httpwg/http-extensions#696

Closed

yoavweiss mentioned this pull request Feb 13, 2019

Client-Hints exposes fingerprint values to additional parties and logging sensitive locations httpwg/http-extensions#767

Closed

yoavweiss mentioned this pull request Mar 15, 2019

Scrolling iframed specs whatwg/whatwg.org#241

Closed

yoavweiss and others added 12 commits March 15, 2019 16:52

Define the ACHL cache and ACHL/ACH processing

1ba8b2d

Removed export

64265d3

Cookie note

15f0eeb

Add ACH and ACHL http-equiv processing

59ff341

Tackled most review comments from Domenic

2cb28f4

s/list/set/

87e43fb

Processing model changes

bb976ad

Added references the header ABNF

9b7dfc8

window object

14c90d7

Mostly-editorial touchups

fd110a5

Only notable thing is using the formal "same origin" concept, and some precision improvements in the meta elements.

Fix worker client hint intialization

3dbf599

Review comments and dfn fixup

ae831a4

yoavweiss added 5 commits March 15, 2019 17:03

Actually fix dfns

d19203d

Move the http dfns to be with their friends

d92b24a

Add image-related Client Hints headers removed from the IETF draft

f57e541

post-rebase fixups

88d4f72

more rebase fixes

44b682a

yoavweiss force-pushed the ACHL_cache2 branch from 7bd134e to 44b682a Compare March 15, 2019 16:42

yoavweiss added 2 commits March 18, 2019 22:20

Added policy controlled features

335f566

s/list/set/

ddb0544

yoavweiss mentioned this pull request Aug 10, 2020

Client Hints infrastructure whatwg/fetch#1072

Closed

Base automatically changed from master to main January 15, 2021 07:57

domenic force-pushed the main branch from 0947339 to 1b5099f Compare July 27, 2021 17:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Define the ACHL cache and ACHL/ACH processing #3774

Define the ACHL cache and ACHL/ACH processing #3774

yoavweiss commented Jun 26, 2018 •

edited by pr-preview bot

Loading

domenic left a comment

domenic Jun 26, 2018

yoavweiss Jun 26, 2018

domenic Jun 26, 2018

domenic Jun 26, 2018

yoavweiss Jun 27, 2018

yoavweiss commented Jun 27, 2018

domenic commented Jun 27, 2018

yoavweiss commented Jun 28, 2018

yoavweiss commented Jun 28, 2018

yoavweiss Jun 28, 2018

domenic commented Jul 2, 2018

yoavweiss left a comment

yoavweiss Jul 3, 2018

yoavweiss commented Jul 3, 2018

annevk left a comment

annevk Aug 13, 2018

yoavweiss Aug 23, 2018

annevk Aug 13, 2018

yoavweiss Aug 23, 2018

annevk Jan 22, 2019

		@@ -97614,6 +97877,14 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {

		</dd>

		<dt>The <span data-x="concept-settings-object-client-hints-set">client-hints set</span></dt>

Define the ACHL cache and ACHL/ACH processing #3774

Are you sure you want to change the base?

Define the ACHL cache and ACHL/ACH processing #3774

Conversation

yoavweiss commented Jun 26, 2018 • edited by pr-preview bot Loading

💥 Error: Wattsi server error 💥

domenic left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yoavweiss commented Jun 27, 2018

domenic commented Jun 27, 2018

yoavweiss commented Jun 28, 2018

yoavweiss commented Jun 28, 2018

Choose a reason for hiding this comment

domenic commented Jul 2, 2018

yoavweiss left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yoavweiss commented Jul 3, 2018

annevk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yoavweiss commented Jun 26, 2018 •

edited by pr-preview bot

Loading