51–60 of 361 posts
Earlier quoted context omitted.
The heuristics to exclude logout links and the like would be very disruptive. Those decisions need to be in the website author's hands. However, I think if browsers had this, but off by default until seeing tags to enable it along with any exclusions, that would be great.
I think it would only prefetch GET links, which never have side effects.
Each time you hover over a link it's doing a GET request bypassing the cache (cache-control: max-age), even if you hove the same multiple times. Also this will make all your analytics false... Except that indeed this can improve greatly the user sensation of speed
Perhaps this something that a browser should be doing, instead of websites themselves?
Enabling it by default Internet-wide seems like it could be a bad idea for many reasons. If I go out of my way to enable it on my site, I am taking responsibility for the bandwidth and any side-effects of prefetching a link and understand what I am doing. But if it is simply enabled Internet-wide, isn't that bordering on a DDoS? What about poorly-coded websites/apps where GETS are not idempotent or have side-effects?…
They're already broken, exposing that is a good thing.
Embedding via // without explicit SSL should probably be considered harmful or malicious as there is no reason to make such scripts available without SSL. Even if the end website is not using SSL users can still fetch your script securely.
The example snippet uses SRI [1], so there's no security issue with plain HTTP. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Earlier quoted context omitted.
The heuristics to exclude logout links and the like would be very disruptive. Those decisions need to be in the website author's hands. However, I think if browsers had this, but off by default until seeing tags to enable it along with any exclusions, that would be great.
I think it would only prefetch GET links, which never have side effects.
It's like pointing to a list of best practices and saying "everyone surely follows these."
For example, someone changed their signature to `[img]/logout.php[/img]` on a forum I posted on as a kid and caused chaos. The mods couldn't remove it because, on the page that lets you modify a user's signature, it shows a signature preview. Good times.
Earlier quoted context omitted.
The communication between the user and example.com downloading the page referring to your script is secured by their SSL if they have it. Separately to that, the communication between the user and your server when downloading your script is secured by your SSL. This can be secure even if example.com is not, so it should only be secure.
If the first html load isn't on SSL, and someone is able to intercept your traffic, they can change the embedded https url to be a non-https url anyway, so I can't even imagine the attack that is prevented by using https into something loaded over http.
When you forgo SSL on your own server someone can also intercept your script in exactly the same way, they don't need to hack the website embedding your script. Now they are your consequences, your fault there's no SSL, and your problem may be affecting everyone who embedded your script insecurely.
Each time you hover over a link it's doing a GET request bypassing the cache (cache-control: max-age), even if you hove the same multiple times. Also this will make all your analytics false... Except that indeed this can improve greatly the user sensation of speed
The analytics should only be triggered is the page is rendered, assuming it's done client side. I believe Google does this for first top 3 results if I'm not mistaken.
Can we see the Cloudflare Worker?
Earlier quoted context omitted.
I think it would only prefetch GET links, which never have side effects.
It could be a way for browsers to encourage GET to be used more correctly.
User happens to brush over the logout button while using the site. On their next click, they're logged out. Weird. Guess I'll just log in again. Doesn't happen again for some time, but then it does. Weird, didn't that happen the other week? What's wrong with my browser? Oh cool, switching browsers fixed it. You're having that issue, too? Don't worry, I figured it out. Just switch browsers.