10 ms·

I work on AMP Real URL at Cloudflare and am happy answer any questions (live from AMPConf in Tokyo)! If you're looking for a super in-depth technical post whic

I work on AMP Real URL at Cloudflare and am happy answer any questions (live from AMPConf in Tokyo)! If you're looking for a super in-depth technical post which includes all sorts of wonderful bits about the engineering and cryptography involved don't miss https://blog.cloudflare.com/real-urls-for-amp-cached-content-using-cloudflare-workers/ https://blog.cloudflare.com/real-urls-for-amp-cached-content... AMP Real URL was built by engineers Avery Harnish (started when Avery was an intern!) and Gabbi Fisher, and is built on top of our Workers [1] tech. 1- https://www.cloudflare.com/products/cloudflare-workers/ https://www.cloudflare.com/products/cloudflare-workers/

negativegate 7y ago
So is this basically the server okaying a replay attack? I'm looking through the technical post but it hasn't clicked yet.
- zackbloom 7y ago
  That's kind of a funny way of thinking about it, buy yes? Loading an AMP page is (hopefully) an action which isn't mutating any state, so I would say it's more similar to how a CDN works. You decide you are interested in having a cache respond to a given request in a specific way, and it responds to requests which look a certain way with that response. In this case it's significantly more secure though, as the exact request and response are signed and a third-party you trust (your browser) is deciding if that signature matches.
- floatingatoll 7y ago
  Analogy: Squid caching with a signature from your SSL certificate that proves it was valid as of when you signed it, so that the browser can trust the Squid cache and display the URL that’s in the signed plaintext with a domain matching that of the certificate that signed the cache blob. Today’s browsers trust all user-configured proxies implicitly and no other proxies at all, so providing a signed copy of the GET-only AMP content, it can be safely cached (the “replay attack”) without needing to trust the cache, because it’s signed plaintext.
- dfabulich 7y ago
  > okaying a replay attack When you permit a proxy to replay your content, it's just caching. It's not an "attack." (If the proxy can replay your content without your permission, that would be an attack.)
  - tyingq 7y ago
    I believe AMP required inserting a piece of Google controlled and hosted JavaScript in your content from the very beginning. So the cat was pretty much out of the bag on this already.
    - themacguffinman 7y ago
      They're certainly not doing it without the website owner's permission. It's disingenuous to call it an attack.
      - tyingq 7y ago
        Yes, that's fair. I meant more in terms of ceding control...that's a prerequisite for AMP, and always has been.
    - paavoova 7y ago
      So if you block this Google JS, you cannot access said AMP page? Does AMP implicitly mandate users subscribe not only to said content provider but the third-party AMP host?
      - tyingq 7y ago
        Yes, you have to include it. "AMP pages must...Contain a <script async src="https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.js "></script> tag inside their <head> tag." https://amp.dev/documentation/guides-and-tutorials/start/create/basic_markup https://amp.dev/documentation/guides-and-tutorials/start/cre... Their special tags[1] won't render without it, and I suspect Google won't include it in their SERPS if it's not valid AMP. [1] https://amp.dev/documentation/guides-and-tutorials/learn/spec/amphtml?format=websites#html-tags https://amp.dev/documentation/guides-and-tutorials/learn/spe...
JohnFen 7y ago
I dislike getting AMP pages, and when I'm served one I can usually find the URL to get to the proper page manually. Does Real URL mean that I can no longer do this? How can I find the URL of the page I really want to see?
- anfilt 7y ago
  Thats a good question can you still access the orginal page then.
  - anfilt 7y ago
    Not sure why I got down voted, but the question I responded to has been answered. The URL structure still has AMP in. So one can access the original page at least.
- cbhl 7y ago
  The URL is now where you'd expect it -- in the address bar. Copy and paste it to a new tab and you're off to the races.
  - dbbk 7y ago
    So in order to get to a non-AMP version of the page, you have to duplicate the tab? The content will be different but the URLs will be the same? How is any ordinary web user supposed to understand this?
  - zackbloom 7y ago
    Correct, it's essentially the same as it is now, but easier as you don't have to worry about removing the "google.com/amp" prefix.
    - JohnFen 7y ago
      OK, thanks.
    - toomuchtodo 7y ago
ficiek 7y ago
What can I do to stop the spread of this harmful technology or at least never get served amp pages?
- darkwizard42 7y ago
  Very constructive comment here. Perhaps you can reword to better understand the value or express why you feel this is harmful technology so OP can help address it.
  - AlexandrB 7y ago
    Personally, I never want to see an AMP page and its ugly design and shitty controls. How do I make this happen? Is there something I can do that will make Cloudflare simply redirect me to the real web page instead?
    - jefftk 7y ago
      It sounds to me like you're talking about the grey bar at the top of pages served from the AMP cache? This change is about using Web Packaging to remove that bar. (Disclosure: I work at Google)
      - stephenr 7y ago
        It sounds like he’s talking about not wanting to have googles bullshit forced on him. This change is about further entrenching googles stranglehold on the web. (Disclosure: You can take AMP and stick it)
      - bsagdiyev 7y ago
        I think he, along with many others, wants Google to stop pushing this garbage on the internet.
ENGNR 7y ago
Couple implementation questions: Who's javascript/cookies run in a real URL amp page, if any? What happens if I hit refresh, does it reload the AMP page or the real page? Can a webpage that isn't Google use real domain AMP pages? In that case, can their javascript influence the page at all? (ie change the look, put elements over it, make http requests)
- gregable 7y ago
  Good questions: > Who's javascript/cookies run in a real URL amp page, if any? The document operates as the signed origin, so cookies, CORS etc all operate as the signed origin (the one in the URL bar). The HTTP request is made using the request URL's origin however, so the server delivering the signed exchange has no cookie access to the signed origin's cookies. > What happens if I hit refresh, does it reload the AMP page or the real page? A refresh will cause the browser to make a normal HTTPS request to the origin in the URL bar. A refresh works identically to what it has in the past, essentially. > Can a webpage that isn't Google use real domain AMP pages? Yes. It is a spec that browsers can support, and any site can use. There is nothing Google specific, or even AMP specific, about the specification. > In that case, can their javascript influence the page at all? (ie change the look, put elements over it, make http requests) No. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates.
snek 7y ago
Could Cloudflare accept a request header that would load up the full page instead of the AMP one? I suspect many people would use such a feature, and it would also be a good way to indicate to Google (and now it seems, Cloudflare as well) the dislike of AMP.
- ocdtrekkie 7y ago
  While it would present a fingerprinting vector, I would likely enthusiastically use a browser extension which effectively disabled AMP.
48309248302 7y ago
You should take a hard look at what you're doing. It's breaking the web by enabling Google to embrace, extend, and extinguish. AMP and Signed HTTP Exchanges aren't agreed upon web standards, and Mozilla calls the technology harmful. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/ https://www.zdnet.com/article/former-mozilla-exec-google-has-sabotaged-firefox-for-years/ https://www.zdnet.com/article/former-mozilla-exec-google-has...
btown 7y ago
Is there any notion of expiration? If I present a signed page to a crawler, what’s to stop them and their partners from serving that page on behalf of my domain for all eternity, and browsers presenting it as valid and authorized by my domain? From retractions to right-to-be-forgotten, there are a billion reasons I would want the ability to disavow cached content.
- Ajedi32 7y ago
  Yes: https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#rfc.section.3.1 https://wicg.github.io/webpackage/draft-yasskin-http-origin-...

negativegate 7y ago

So is this basically the server okaying a replay attack? I'm looking through the technical post but it hasn't clicked yet.

zackbloom 7y ago
That's kind of a funny way of thinking about it, buy yes? Loading an AMP page is (hopefully) an action which isn't mutating any state, so I would say it's more similar to how a CDN works. You decide you are interested in having a cache respond to a given request in a specific way, and it responds to requests which look a certain way with that response. In this case it's significantly more secure though, as the exact request and response are signed and a third-party you trust (your browser) is deciding if that signature matches.
floatingatoll 7y ago
Analogy: Squid caching with a signature from your SSL certificate that proves it was valid as of when you signed it, so that the browser can trust the Squid cache and display the URL that’s in the signed plaintext with a domain matching that of the certificate that signed the cache blob. Today’s browsers trust all user-configured proxies implicitly and no other proxies at all, so providing a signed copy of the GET-only AMP content, it can be safely cached (the “replay attack”) without needing to trust the cache, because it’s signed plaintext.
dfabulich 7y ago
> okaying a replay attack When you permit a proxy to replay your content, it's just caching. It's not an "attack." (If the proxy can replay your content without your permission, that would be an attack.)
- tyingq 7y ago
  I believe AMP required inserting a piece of Google controlled and hosted JavaScript in your content from the very beginning. So the cat was pretty much out of the bag on this already.
  - themacguffinman 7y ago
    They're certainly not doing it without the website owner's permission. It's disingenuous to call it an attack.
    - tyingq 7y ago
      Yes, that's fair. I meant more in terms of ceding control...that's a prerequisite for AMP, and always has been.
  - paavoova 7y ago
    So if you block this Google JS, you cannot access said AMP page? Does AMP implicitly mandate users subscribe not only to said content provider but the third-party AMP host?
    - tyingq 7y ago
      Yes, you have to include it. "AMP pages must...Contain a <script async src="https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.js "></script> tag inside their <head> tag." https://amp.dev/documentation/guides-and-tutorials/start/create/basic_markup https://amp.dev/documentation/guides-and-tutorials/start/cre... Their special tags[1] won't render without it, and I suspect Google won't include it in their SERPS if it's not valid AMP. [1] https://amp.dev/documentation/guides-and-tutorials/learn/spec/amphtml?format=websites#html-tags https://amp.dev/documentation/guides-and-tutorials/learn/spe...

JohnFen 7y ago

I dislike getting AMP pages, and when I'm served one I can usually find the URL to get to the proper page manually. Does Real URL mean that I can no longer do this? How can I find the URL of the page I really want to see?

anfilt 7y ago
Thats a good question can you still access the orginal page then.
- anfilt 7y ago
  Not sure why I got down voted, but the question I responded to has been answered. The URL structure still has AMP in. So one can access the original page at least.
cbhl 7y ago
The URL is now where you'd expect it -- in the address bar. Copy and paste it to a new tab and you're off to the races.
- dbbk 7y ago
  So in order to get to a non-AMP version of the page, you have to duplicate the tab? The content will be different but the URLs will be the same? How is any ordinary web user supposed to understand this?
- zackbloom 7y ago
  Correct, it's essentially the same as it is now, but easier as you don't have to worry about removing the "google.com/amp" prefix.
  - JohnFen 7y ago
    OK, thanks.
  - toomuchtodo 7y ago

ficiek 7y ago

What can I do to stop the spread of this harmful technology or at least never get served amp pages?

darkwizard42 7y ago
Very constructive comment here. Perhaps you can reword to better understand the value or express why you feel this is harmful technology so OP can help address it.
- AlexandrB 7y ago
  Personally, I never want to see an AMP page and its ugly design and shitty controls. How do I make this happen? Is there something I can do that will make Cloudflare simply redirect me to the real web page instead?
  - jefftk 7y ago
    It sounds to me like you're talking about the grey bar at the top of pages served from the AMP cache? This change is about using Web Packaging to remove that bar. (Disclosure: I work at Google)
    - stephenr 7y ago
      It sounds like he’s talking about not wanting to have googles bullshit forced on him. This change is about further entrenching googles stranglehold on the web. (Disclosure: You can take AMP and stick it)
    - bsagdiyev 7y ago
      I think he, along with many others, wants Google to stop pushing this garbage on the internet.

ENGNR 7y ago

Couple implementation questions: Who's javascript/cookies run in a real URL amp page, if any? What happens if I hit refresh, does it reload the AMP page or the real page? Can a webpage that isn't Google use real domain AMP pages? In that case, can their javascript influence the page at all? (ie change the look, put elements over it, make http requests)

gregable 7y ago
Good questions: > Who's javascript/cookies run in a real URL amp page, if any? The document operates as the signed origin, so cookies, CORS etc all operate as the signed origin (the one in the URL bar). The HTTP request is made using the request URL's origin however, so the server delivering the signed exchange has no cookie access to the signed origin's cookies. > What happens if I hit refresh, does it reload the AMP page or the real page? A refresh will cause the browser to make a normal HTTPS request to the origin in the URL bar. A refresh works identically to what it has in the past, essentially. > Can a webpage that isn't Google use real domain AMP pages? Yes. It is a spec that browsers can support, and any site can use. There is nothing Google specific, or even AMP specific, about the specification. > In that case, can their javascript influence the page at all? (ie change the look, put elements over it, make http requests) No. Conceptually, you can think of a signed exchange as a 301 redirect to a new URL which has already been cached by the browser (so there is no 2nd network event). The cache was populated by the contents of the signed exchange, assuming the signature validates.

snek 7y ago

Could Cloudflare accept a request header that would load up the full page instead of the AMP one? I suspect many people would use such a feature, and it would also be a good way to indicate to Google (and now it seems, Cloudflare as well) the dislike of AMP.

ocdtrekkie 7y ago
While it would present a fingerprinting vector, I would likely enthusiastically use a browser extension which effectively disabled AMP.

48309248302 7y ago

You should take a hard look at what you're doing. It's breaking the web by enabling Google to embrace, extend, and extinguish. AMP and Signed HTTP Exchanges aren't agreed upon web standards, and Mozilla calls the technology harmful. https://mozilla.github.io/standards-positions/ https://mozilla.github.io/standards-positions/ https://www.zdnet.com/article/former-mozilla-exec-google-has-sabotaged-firefox-for-years/ https://www.zdnet.com/article/former-mozilla-exec-google-has...

btown 7y ago

Is there any notion of expiration? If I present a signed page to a crawler, what’s to stop them and their partners from serving that page on behalf of my domain for all eternity, and browsers presenting it as valid and authorized by my domain? From retractions to right-to-be-forgotten, there are a billion reasons I would want the ability to disavow cached content.

Ajedi32 7y ago
Yes: https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#rfc.section.3.1 https://wicg.github.io/webpackage/draft-yasskin-http-origin-...