Firefox 90 supports Fetch Metadata Request Headers • Hacker News Board

Re: Firefox 90 supports Fetch Metadata Request Headers

#11

Post by elken » Mon, Jul 12, 2021, 1:16 PM UTC

taf2 wrote: post #3

wronex wrote: post #2

How is this different from the origin header? Does the origin header not tell the webbserver if the requested originated from the same website? Is the origin header flawed in some way?

It seems silly to me too but re reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or... “ There are some exceptions to the above rules; for example if a cross-origin GET or HEAD request is made in no-cors mode the Origin header will not be added.”

That's an interesting find thanks. I was not aware of no-cors mode.

It seems though that a browser would not allow 'non-simple' headers in no-cors mode[0].

Authorization headers for example would not be allowed (if i'm reading correctly). So any API using that header would not be affected by this issue right?

[0] https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...

Re: Firefox 90 supports Fetch Metadata Request Headers

#12

Post by drchickensalad » Mon, Jul 12, 2021, 1:16 PM UTC

dathinab wrote: post #8

alexghr wrote: post #4

Earlier quoted context omitted.

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for or a top-level document). This spec seems really powerful, provided all browser support it :) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe…

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

Re: Firefox 90 supports Fetch Metadata Request Headers

#13

Post by contravariant » Mon, Jul 12, 2021, 1:17 PM UTC

ChrisSD wrote: post #7

drtgh wrote: post #5

Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9 This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers. From the article, "If you aren’t a Firefox user yet, you can dow…

If ESNI is fundamentally flawed, how is it better than nothing at all? At that point isn't it just cargo cult "protection"?

You're gonna have to support the statement that ESNI is fundamentally flawed a bit better for that argument to work.

Re: Firefox 90 supports Fetch Metadata Request Headers

#14

Post by userbinator » Mon, Jul 12, 2021, 1:25 PM UTC

dathinab wrote: post #9

anonymfus wrote: post #6

Does that mean that the quest of finding a working direct link to the image/video will soon become impossible?

If site producers want to it's already pretty much impossible today. At least without some "tricks", and nothing prevents your video-downloader from just adding a header which pretend it's origin is a website. (Or more funny you inject the downloading JS code into the website in question extending it with a download functionality ;=) ).

There's a difference between only allowing that behaviour, and explicitly creating features to enable it.

This sounds like Referer, but worse.

Re: Firefox 90 supports Fetch Metadata Request Headers

#15

Post by orf » Mon, Jul 12, 2021, 1:34 PM UTC

drtgh wrote: post #5

Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9 This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers. From the article, "If you aren’t a Firefox user yet, you can dow…

Read why here: https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

Re: Firefox 90 supports Fetch Metadata Request Headers

#16

Post by [deleted] » Mon, Jul 12, 2021, 1:38 PM UTC

drchickensalad wrote: post #12

dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

[deleted]

Re: Firefox 90 supports Fetch Metadata Request Headers

#17

Post by Dah00n » Mon, Jul 12, 2021, 1:40 PM UTC

drchickensalad wrote: post #12

dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

I have done web-development both in the bad IE days but also recently and IMO it wasn't as bad to develop for IE as it is for Safari today. Safari is broken in strange and random ways and missing odd features and is a moving target (and seem to break more with time). Developing for IE was extremely well documented (especially in later versions) and avoiding pitfalls was very easy, even for people new to creating webpages using a few Google searches. Not so for Safari - unless you cut it completely off from all modern advances on the web. It just felt worse back then because IE was much more widespread.

Re: Firefox 90 supports Fetch Metadata Request Headers

#18

Post by sgift » Mon, Jul 12, 2021, 1:40 PM UTC

drchickensalad wrote: post #12

dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

And even for the same reason: If the browser was too good "no one" (very loosely defined here) would need to buy Apps anymore. :(

Re: Firefox 90 supports Fetch Metadata Request Headers

#19

Post by lallysingh » Mon, Jul 12, 2021, 1:42 PM UTC

contravariant wrote: post #13

ChrisSD wrote: post #7

Earlier quoted context omitted.

If ESNI is fundamentally flawed, how is it better than nothing at all? At that point isn't it just cargo cult "protection"?

You're gonna have to support the statement that ESNI is fundamentally flawed a bit better for that argument to work.

From Mozilla link above: Since publication of the ESNI draft specification at the IETF, analysis has shown that encrypting only the SNI extension provides incomplete protection. As just one example: during session resumption, the Pre-Shared Key extension could, legally, contain a cleartext copy of exactly the same server name that is encrypted by ESNI. The ESNI approach would require an encrypted variant of every extension with potential privacy implications, and even that exposes the set of extensions advertised. Lastly, real-world use of ESNI has exposed interoperability and deployment challenges that prevented it from being enabled at a wider scale.

Re: Firefox 90 supports Fetch Metadata Request Headers

#20

Post by dbg31415 » Mon, Jul 12, 2021, 1:56 PM UTC

Any idea when they'll fix Firefox so you can make streaming calls without turning your MBP into a toaster? 40x the battery usage vs. Safari when on a streaming call. It's so painful. Heh, literally. The machine gets too hot to hold comfortably. It's still my primary browser, but optimization is needed. Sucks to have to change browsers just to make calls. We live on streaming calls now. This has been an issue since at least the start of Covid when I first really noticed it.