4 ms·
Okay, great, Chrome has a place where you can delete HSTS pins. Now how do I delete a cached Accept-CH value? It's been two months and any computer I accessed
by derefr 3y ago
Okay, great, Chrome has a place where you can delete HSTS pins.
Now how do I delete a cached Accept-CH value? It's been two months and any computer I accessed the test server through while it was sending the bad Accept-CH value, still chokes for literally any request made to the test domain. (And no, clearing site data doesn't do anything.)
(If you're wondering what I did that screwed things up so bad: I had the server send an Accept-CH response header in response to an OPTIONS request, in the hopes that it would be delivered in the CORS preflight and therefore get me high-entropy client hints sent in the actual [same-site] XHR. It was delivered in the CORS preflight alright...)
- justinclift 3y agoSounds like you'd need to delete your browser user profile (which holds all the stored info for your user), so it starts a new "empty" one like a new user would have.
- packetlost 3y agoThat's the nuclear option though. It shouldn't be necessary.
- phone8675309 3y agoIt shouldn't be, but this is such a corner case that I would assume that the developers never considered it.
- derefr 3y agoI mean, "whoopsie" bad pins are the main reason that most headers that indicate caching have max enforced cache lifetimes. According to a previous draft of the Client Hints spec, Accept-CH's cache lifetime was supposed to only be 10 minutes, for exactly that reason! But apparently the only implementation so far (in Chromium) didn't have any internal TTL-based eviction logic for these entries at all...
- deleted 3y ago[deleted]