Cross-origin fetches - HTTP 203

Поделиться
HTML-код
  • Опубликовано: 10 дек 2024

Комментарии • 59

  • @lele_l
    @lele_l 4 года назад +32

    Http 203 is easily one of my favourite shows on RUclips :D

  • @wmhilton-old
    @wmhilton-old 4 года назад +33

    I was with you up until CORP and then I got lost 😂. I'll have to rewatch and pause it.

    • @wmhilton-old
      @wmhilton-old 4 года назад +1

      Alright, got it!

    • @brentgreeff1115
      @brentgreeff1115 4 года назад +2

      Is it my imagination or has this vid been sped up by 10% or so?

    • @jakearchibald
      @jakearchibald 4 года назад

      Nah, we just talk a bit too fast

    • @brentgreeff1115
      @brentgreeff1115 4 года назад

      @@jakearchibald - I bet 10 Google Bucks its sped up = interesting vid though.

    • @jakearchibald
      @jakearchibald 4 года назад +1

      ​@@brentgreeff1115​ you just lost 10 Google Bucks

  • @nonlogos
    @nonlogos 2 года назад +3

    I need a 3 hr deep dive video on this

  • @driziiD
    @driziiD 4 года назад +5

    when are we going to give these guys their golden globe award

  • @CyberAcidPlanet
    @CyberAcidPlanet 4 года назад +9

    I liked the plot progression in this episode, especially the reveal in the end. Felt like some super villain was defeated!

  • @MaxCoplan
    @MaxCoplan 4 года назад +3

    This was a fantastic episode. I learned a bunch, and now I want more! You should make a bonus episode with all the "boring" details you cut out

  • @driziiD
    @driziiD 4 года назад +2

    thank you for explaining CORS. I can finally stop having recurring nightmares about it. my therapist will be pleased.

  • @Zolbat
    @Zolbat 4 года назад +4

    The big try catch block to figure out the correct string to use depending on the version of browser the user has, really reminds me of iOS these days with all the switches depending on what kind of notch phone you have

  • @IanJamesPhotography
    @IanJamesPhotography 4 года назад

    Waited 23 minutes for the dog promised by the video thumbnail.
    Worth it.

  • @jcestibariz
    @jcestibariz 4 года назад +1

    Some reference material:
    CORP: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
    CORB: www.chromium.org/Home/chromium-security/corb-for-developers
    nosniff: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
    COEP: wicg.github.io/cross-origin-embedder-policy/

  • @mustafwm
    @mustafwm 4 года назад +5

    Thanks guys
    Just one request: If you can assume a bit less knowledge from us next time, that'd be great :)
    Some of those concepts/examples seemed a bit advanced and were just glanced over, it would have been more helpful if they were explained a bit more.
    Thanks again :)
    Looking forward to the tracking episode

    • @jakearchibald
      @jakearchibald 4 года назад +2

      This is really good feedback, thanks. What kinds of things could have done with more detail? The first half of this episode ran longer than I intended, so I think I rushed the rest, sorry!

    • @mustafwm
      @mustafwm 4 года назад +3

      @@jakearchibald Thanks for your reply.
      Actually it's first section that I wish it had more explanation .. those mistakes/risks of current cookies implementation...
      how sending someone to some form on your website can result in you reading their cookies and causing damage?
      having an onLoad event on avatar image load? what's potentially being leaked? how's sending the Origin header with POST can prevent that?
      PS: I really enjoyed the episode, and have learned a lot from you guys here & on twitter (don't mean to be critical here). Thanks :)

    • @TheNewton
      @TheNewton 4 года назад

      ​@@jakearchibald With CORS's problems&solutions growing more mazelike, I'm not sure the discussion format alone can demystify it.
      I think it it has to be vid&handson maybe a walkthrough setup and pentest showing the problem, and not just a subtopic of other things like lab-fetch-api it's own focused lab on webfundamentals( or websecurityfundamentals even) .

    • @taskforce_kerim
      @taskforce_kerim 4 года назад +1

      @@jakearchibald I think a more detailed explanation or examples of a bad situation would be good. For example, many times it's not exactly clear which site is the evil site. Is it example.com or the site fetching from example.com? If i t's the site fetching from example.com, how can it read the cookie content of example.com? Can site A intercept the get request to site B?

  • @flightvision
    @flightvision 2 года назад

    +1 for a whole episode about unwanted information sharing (tracking) ("Sad User" ;) ). Your topics are always very interesting it is just hard to follow along sometimes as a non-native speaker.

  • @DenisTRUFFAUT
    @DenisTRUFFAUT 4 года назад +2

    Web workers gonna love Cross-Origin-Embedder-Policy !

  • @honmameiko1333
    @honmameiko1333 4 года назад +1

    Glad to know the sameSite policy change has been resumed😂

  • @TheNewton
    @TheNewton 4 года назад

    1:50 pdfs, may be a competitor since mosaic could display them but AFAIK that may only been while on the file path so maybe not a pure sub resource except in however they programmed it to display in a html browser, and ummm actually there was no tag in the spec which probably also rules out any stylesheet prototypes.

    • @jakearchibald
      @jakearchibald 4 года назад

      Yeah, I don't think it was a subresource, just a top-level navigation.

  • @api-first
    @api-first 4 года назад +2

    Well, this turned into a reality show quickly ...

  • @joshkramer2435
    @joshkramer2435 4 года назад +3

    Already subscribed, but Watson got me to click the bell!

  • @nivoset
    @nivoset 4 года назад +2

    Especially with micro front ends coming up. Something needs to be worked out

  • @danielni
    @danielni 4 года назад +2

    So we should still implement CSRF tokens until all browsers support SameSite=Lax?

    • @jakearchibald
      @jakearchibald 4 года назад +5

      If you're targeting browsers that don't support SameSite, then yes, you'll need an alternative. The Origin header can be simpler than tokens, but again it depends on browser support. Also, this stuff doesn't work if you have GET endpoints that perform actions, but y'know, you shouldn't have those.

  • @nobodyz2700
    @nobodyz2700 4 года назад +1

    yeah... 2020 is pretty bad for breaking changes...

  • @googleplexer
    @googleplexer 4 года назад

    «got me notes» - it’s awesome 😎 😂

  • @danilaplee
    @danilaplee 4 года назад +2

    omg this is such a hot topic!!!

  • @davidmaxwaterman
    @davidmaxwaterman 4 года назад

    What about the problem with losing the cookies (eg sessionid) when your app is added to homescreen on iOS, where your index.html has been cached by the service worker...and/or you're now offline? It works in-browser, but not from homescreen.

  • @ancientelevator9
    @ancientelevator9 2 года назад

    I feel like you should have introduced the class of problems at the beginning, as well as a walkthrough of some examples.

  • @maistho
    @maistho 4 года назад +1

    That's a lovely dog :)

  • @CardinalHijack
    @CardinalHijack 4 года назад

    Hey Jake, I find it super interesting at 1:35 where you said you were not allowed on the internet, and "nobody knew what the internet was". So I wonder how you got into it? You often find that industry leaders like yourself started coding on a PC when they were around 9 (not that its necessary, but you tend to notice early introduction to tech), so I found it interesting that you seem to state the opposite.

    • @jakearchibald
      @jakearchibald 4 года назад +1

      I tinkered around with bits of BASIC when I was 7 I guess, but I was more interested in graphical design & animation until I was in my late teens

    • @CardinalHijack
      @CardinalHijack 4 года назад

      Jake Archibald interesting. Thanks for the reply

  • @Dygear
    @Dygear 4 года назад +1

    CORB-on-the-COB.

  • @kyay10
    @kyay10 4 года назад +3

    Can you make a video explaining what Meltdown and Spectre is and how it worked and stuff like that? Cuz y'all keep mentioning it, and it honestly sounds pretty interesting!

    • @jakearchibald
      @jakearchibald 4 года назад +3

      ruclips.net/video/dBuykrdhK-A/видео.html might do the trick

    • @MaxCoplan
      @MaxCoplan 4 года назад

      @@jakearchibald When will I get my precious SharedArrayBuffers back in all the major browsers 😫? Shoutouts to Chrome at least for getting them back asap, but hard to invest a lot in them without support from WebKit. Cheers

  • @eduardoreis8500
    @eduardoreis8500 4 года назад

    Would you share that presentation?

  • @Cookie_Wookie_7
    @Cookie_Wookie_7 3 года назад

    When is the cross sure tracking episode

    • @jakearchibald
      @jakearchibald 3 года назад

      Oh yeah, we haven't done this yet (although I've mentioned parts of it in other talks), although there's blog.google/products/ads-commerce/a-more-privacy-first-web if you want to know the latest

  • @DavidElstob73
    @DavidElstob73 4 года назад

    Guys, is it actually possible to Server Push self-hosted fonts?
    When I add crossorigin my push degrades to a preload. It's super annoying and I can't find a solution. You are my last hope. :)

    • @jakearchibald
      @jakearchibald 4 года назад +1

      You might be being tripped up by jakearchibald.com/2017/h2-push-tougher-than-i-thought/#requests-without-credentials-use-a-separate-connection. Server push is generally bad.

  • @albertodeagostini6143
    @albertodeagostini6143 4 года назад

    You should show Watson more often

  • @frutiboy1
    @frutiboy1 3 года назад

    This was hard to learn much from it :,-)

  • @hobbyturystaSEO
    @hobbyturystaSEO 4 года назад

    what about cors at firebase ?

  • @vengateshvaidyanathang550
    @vengateshvaidyanathang550 3 года назад

    Guys please provide a gist of entire code at the final minutes..

  • @shobhitchittora2267
    @shobhitchittora2267 4 года назад

    Eye opening!

  • @joshuvageorge1678
    @joshuvageorge1678 3 года назад

    what is subresource? :

  • @duncan-dean
    @duncan-dean 4 года назад +1

    Wow nice secret in description.

  • @gettingthingsdone
    @gettingthingsdone 4 года назад +3

    caring about privacy on the web.
    working at Google. :D

  • @davidmaxwaterman
    @davidmaxwaterman 4 года назад

    I had to unsubscribe in order to subscribe....ditto for the bell.

  • @aham3687
    @aham3687 4 года назад

    Tongue twister