4 ms·

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the req

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for <audio> or a top-level document). This spec seems really powerful, provided all browser support it :) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fetch_metadata_request_headers https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe...

dathinab 5y ago
Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which would add additional protection against certain attacks for all users except the ones stuck on IE or Safari.
- drchickensalad 5y ago
  Safari truly is IE in 2021
  - deleted 5y ago
    [deleted]
  - Dah00n 5y ago
    I have done web-development both in the bad IE days but also recently and IMO it wasn't as bad to develop for IE as it is for Safari today. Safari is broken in strange and random ways and missing odd features and is a moving target (and seem to break more with time). Developing for IE was extremely well documented (especially in later versions) and avoiding pitfalls was very easy, even for people new to creating webpages using a few Google searches. Not so for Safari - unless you cut it completely off from all modern advances on the web. It just felt worse back then because IE was much more widespread.
    - vanviegen 5y ago
      Were you actually doing any serious web development in the mid 2000s? Because I have a feeling you wouldn't be saying this if you were.. :-)
      - Dah00n 5y ago
        I can see that came out wrong. I'll try to rephrase...
  - sgift 5y ago
    And even for the same reason: If the browser was too good "no one" (very loosely defined here) would need to buy Apps anymore. :(
  - atonse 5y ago
    I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine? Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more polished. But this was more like a tweet so take that anecdata with a grain of salt.
    - vbezhenar 5y ago
      Absence of push notifications makes it impossible to develop a lots of web apps. Also more user-friendly way to install desktop shortcut would help tremendously to make web apps more popular. Of course Apple is not interested with that, but it's still sad.
    - danielheath 5y ago
      I often try to use a feature and it doesn't work properly on one browser. It's nearly always mobile safari. This week, I've dealt with scroll-snap (which makes URL anchors work correctly with a sticky header) being supported but only for some layouts (every other browser works). Today I spent hours debugging why pages with a particular iframe embed would log you out of the parent site on Safari / iOS. Possibly because the same first-party resource was requested from both outside and inside the frame? Not sure yet. If you attempt to use localStorage from a private tab on safari, it reports that it's present and working, but raises an exception on any access (every other platform either does not expose localStorage in private tabs, or clears it after).
    - darthmaim 5y ago
      Here are some examples: https://infrequently.org/2021/04/progress-delayed/ https://infrequently.org/2021/04/progress-delayed/
    - speedgoose 5y ago
      An an user, safari is great. Has a web developer, safari is hell.
  - machello13 5y ago
    Everytime some web**** says this it's because of some esoteric unsupported spec where there's no answer to the question "okay, but why would I want my browser to support this?"
  - twsted 5y ago
    This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago: 1. it was largely dominant, so people thought they could develop just taking that browser in consideration 2. for the previous point, MS started to develop proprietary features (like ActiveX) 3. at a certain point its development was stopped for a long time Safari certainly cannot match the first two reasons. But it cannot match the third either, because the development of standard web features is going on at good pace (see <https://webkit.org/status/ https://webkit.org/status/>).
    - Ajedi32 5y ago
      Those might be the reasons why users disliked IE, but the reason developers dislike IE were/are somewhat different: 1. It doesn't support many of the latest web standards 2. A large enough percentage of users use it that it can't be simply ignored Both of those points apply to modern Safari. Less so to IE these days as #2 becomes less and less applicable; hence "Safari is the new IE".
    - reader_mode 5y ago
      Developers hated having to work around missing features for IE even when FF and Chrome took over the market, Safari is the exact same, except you can't even update the rendering engine on iOS, Apple doesn't want webapps to eat away at app store profit (notice how shitty and slow moving the webgl/webgpu thing has been mostly due to iOS Safari)
    - no_way 5y ago
      Right now but you can reasonably develop a website which will work in Chrome and Firefox even without testing (not talking about any supper modern features), but Safari is riddled with bugs you wouldn't expect. Recently I have encountered multiple bugs regarding svg clipping in safari. Safari 14 also broke localstorage and indexeddb it's almost funny how bad safari is at actually just working.
      - iggldiggl 5y ago
        My homepage is tiny and absolutely nothing fancy, but I've still managed to immediately run into at least two Chrome bugs.
  - robertoandred 5y ago
    People who say this never had to develop for IE.
  - philistine 5y ago
    Let's completely sidestep the whole debate that we always have. This is a safety feature, Safari will implement it, you can bet on it. It's merely going to be the last to do it.
    - thayne 5y ago
      And yet safari is the last major browser to implement it.
- Cyph0n 5y ago
  > supper-seeded I think you meant superseded (pronounced super-seeded).
  - rrdharan 5y ago
    Fascinating, TIL that superseded is correct and superceded is and has been wrong for four hundred years :): https://www.merriam-webster.com/dictionary/supercede https://www.merriam-webster.com/dictionary/supercede
- alexghr 5y ago
  Yep, I don't know why my first thought was that malicious actors could just bypass this by using external HTTP clients (like curl) when in fact this spec is meant to augment CORS: browsers _will_ send these headers to the server and the server can choose to honour them or not (well, in the CORS case the browser will block the request if the response headers are incorrect). It's defense in depth :D

dathinab 5y ago

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which would add additional protection against certain attacks for all users except the ones stuck on IE or Safari.

drchickensalad 5y ago
Safari truly is IE in 2021
- deleted 5y ago
  [deleted]
- Dah00n 5y ago
  I have done web-development both in the bad IE days but also recently and IMO it wasn't as bad to develop for IE as it is for Safari today. Safari is broken in strange and random ways and missing odd features and is a moving target (and seem to break more with time). Developing for IE was extremely well documented (especially in later versions) and avoiding pitfalls was very easy, even for people new to creating webpages using a few Google searches. Not so for Safari - unless you cut it completely off from all modern advances on the web. It just felt worse back then because IE was much more widespread.
  - vanviegen 5y ago
    Were you actually doing any serious web development in the mid 2000s? Because I have a feeling you wouldn't be saying this if you were.. :-)
    - Dah00n 5y ago
      I can see that came out wrong. I'll try to rephrase...
- sgift 5y ago
  And even for the same reason: If the browser was too good "no one" (very loosely defined here) would need to buy Apps anymore. :(
- atonse 5y ago
  I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine? Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more polished. But this was more like a tweet so take that anecdata with a grain of salt.
  - vbezhenar 5y ago
    Absence of push notifications makes it impossible to develop a lots of web apps. Also more user-friendly way to install desktop shortcut would help tremendously to make web apps more popular. Of course Apple is not interested with that, but it's still sad.
  - danielheath 5y ago
    I often try to use a feature and it doesn't work properly on one browser. It's nearly always mobile safari. This week, I've dealt with scroll-snap (which makes URL anchors work correctly with a sticky header) being supported but only for some layouts (every other browser works). Today I spent hours debugging why pages with a particular iframe embed would log you out of the parent site on Safari / iOS. Possibly because the same first-party resource was requested from both outside and inside the frame? Not sure yet. If you attempt to use localStorage from a private tab on safari, it reports that it's present and working, but raises an exception on any access (every other platform either does not expose localStorage in private tabs, or clears it after).
  - darthmaim 5y ago
    Here are some examples: https://infrequently.org/2021/04/progress-delayed/ https://infrequently.org/2021/04/progress-delayed/
  - speedgoose 5y ago
    An an user, safari is great. Has a web developer, safari is hell.
- machello13 5y ago
  Everytime some web**** says this it's because of some esoteric unsupported spec where there's no answer to the question "okay, but why would I want my browser to support this?"
- twsted 5y ago
  This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago: 1. it was largely dominant, so people thought they could develop just taking that browser in consideration 2. for the previous point, MS started to develop proprietary features (like ActiveX) 3. at a certain point its development was stopped for a long time Safari certainly cannot match the first two reasons. But it cannot match the third either, because the development of standard web features is going on at good pace (see <https://webkit.org/status/ https://webkit.org/status/>).
  - Ajedi32 5y ago
    Those might be the reasons why users disliked IE, but the reason developers dislike IE were/are somewhat different: 1. It doesn't support many of the latest web standards 2. A large enough percentage of users use it that it can't be simply ignored Both of those points apply to modern Safari. Less so to IE these days as #2 becomes less and less applicable; hence "Safari is the new IE".
  - reader_mode 5y ago
    Developers hated having to work around missing features for IE even when FF and Chrome took over the market, Safari is the exact same, except you can't even update the rendering engine on iOS, Apple doesn't want webapps to eat away at app store profit (notice how shitty and slow moving the webgl/webgpu thing has been mostly due to iOS Safari)
  - no_way 5y ago
    Right now but you can reasonably develop a website which will work in Chrome and Firefox even without testing (not talking about any supper modern features), but Safari is riddled with bugs you wouldn't expect. Recently I have encountered multiple bugs regarding svg clipping in safari. Safari 14 also broke localstorage and indexeddb it's almost funny how bad safari is at actually just working.
    - iggldiggl 5y ago
      My homepage is tiny and absolutely nothing fancy, but I've still managed to immediately run into at least two Chrome bugs.
- robertoandred 5y ago
  People who say this never had to develop for IE.
- philistine 5y ago
  Let's completely sidestep the whole debate that we always have. This is a safety feature, Safari will implement it, you can bet on it. It's merely going to be the last to do it.
  - thayne 5y ago
    And yet safari is the last major browser to implement it.
Cyph0n 5y ago
> supper-seeded I think you meant superseded (pronounced super-seeded).
- rrdharan 5y ago
  Fascinating, TIL that superseded is correct and superceded is and has been wrong for four hundred years :): https://www.merriam-webster.com/dictionary/supercede https://www.merriam-webster.com/dictionary/supercede
alexghr 5y ago
Yep, I don't know why my first thought was that malicious actors could just bypass this by using external HTTP clients (like curl) when in fact this spec is meant to augment CORS: browsers _will_ send these headers to the server and the server can choose to honour them or not (well, in the CORS case the browser will block the request if the response headers are incorrect). It's defense in depth :D