Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 90 supports Fetch Metadata Request Headers

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 109 posts

Re: Firefox 90 supports Fetch Metadata Request Headers

#21

Post by vanviegen »

Dah00n wrote: post #17
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

I have done web-development both in the bad IE days but also recently and IMO it wasn't as bad to develop for IE as it is for Safari today. Safari is broken in strange and random ways and missing odd features and is a moving target (and seem to break more with time). Developing for IE was extremely well documented (especially in later versions) and avoiding pitfalls was very easy, even for people new to creating webp…

Were you actually doing any serious web development in the mid 2000s? Because I have a feeling you wouldn't be saying this if you were.. :-)

Re: Firefox 90 supports Fetch Metadata Request Headers

#22

Post by Cyph0n »

dathinab wrote: post #8
alexghr wrote: post #4

Earlier quoted context omitted.

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for or a top-level document). This spec seems really powerful, provided all browser support it :) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe…

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

> supper-seeded

I think you meant superseded (pronounced super-seeded).

Re: Firefox 90 supports Fetch Metadata Request Headers

#24

Post by llacb47 »

dbg31415 wrote: post #20

Any idea when they'll fix Firefox so you can make streaming calls without turning your MBP into a toaster? 40x the battery usage vs. Safari when on a streaming call. It's so painful. Heh, literally. The machine gets too hot to hold comfortably. It's still my primary browser, but optimization is needed. Sucks to have to change browsers just to make calls. We live on streaming calls now. This has been an issue since at…

what is a streaming call? webrtc applications like google meet?

Re: Firefox 90 supports Fetch Metadata Request Headers

#25

Post by atonse »

drchickensalad wrote: post #12
dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine?

Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more polished. But this was more like a tweet so take that anecdata with a grain of salt.

Re: Firefox 90 supports Fetch Metadata Request Headers

#26

Post by alexghr »

dathinab wrote: post #8
alexghr wrote: post #4

Earlier quoted context omitted.

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for or a top-level document). This spec seems really powerful, provided all browser support it :) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe…

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Yep, I don't know why my first thought was that malicious actors could just bypass this by using external HTTP clients (like curl) when in fact this spec is meant to augment CORS: browsers _will_ send these headers to the server and the server can choose to honour them or not (well, in the CORS case the browser will block the request if the response headers are incorrect).

It's defense in depth :D

Re: Firefox 90 supports Fetch Metadata Request Headers

#27

Post by machello13 »

drchickensalad wrote: post #12
dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

Everytime some web**** says this it's because of some esoteric unsupported spec where there's no answer to the question "okay, but why would I want my browser to support this?"

Re: Firefox 90 supports Fetch Metadata Request Headers

#28

Post by Dah00n »

vanviegen wrote: post #21
Dah00n wrote: post #17

Earlier quoted context omitted.

I have done web-development both in the bad IE days but also recently and IMO it wasn't as bad to develop for IE as it is for Safari today. Safari is broken in strange and random ways and missing odd features and is a moving target (and seem to break more with time). Developing for IE was extremely well documented (especially in later versions) and avoiding pitfalls was very easy, even for people new to creating webp…

Were you actually doing any serious web development in the mid 2000s? Because I have a feeling you wouldn't be saying this if you were.. :-)

I can see that came out wrong. I'll try to rephrase...

Re: Firefox 90 supports Fetch Metadata Request Headers

#29

Post by floatingatoll »

dbg31415 wrote: post #20

Any idea when they'll fix Firefox so you can make streaming calls without turning your MBP into a toaster? 40x the battery usage vs. Safari when on a streaming call. It's so painful. Heh, literally. The machine gets too hot to hold comfortably. It's still my primary browser, but optimization is needed. Sucks to have to change browsers just to make calls. We live on streaming calls now. This has been an issue since at…

That sounds like a reproducible bug report, with an easy test case (“run this script and measure laptop battery life, in Firefox and Safari”). If you haven’t already provided that in a bug report to the software developers, you should do so. Shopping your concern to an unrelated thread about security headers isn’t likely to get far on HN, certainly nowhere near as much as a testable bug would.

Re: Firefox 90 supports Fetch Metadata Request Headers

#30

Post by twsted »

drchickensalad wrote: post #12
dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

Safari truly is IE in 2021

This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago:

1. it was largely dominant, so people thought they could develop just taking that browser in consideration

2. for the previous point, MS started to develop proprietary features (like ActiveX)

3. at a certain point its development was stopped for a long time

Safari certainly cannot match the first two reasons. But it cannot match the third either, because the development of standard web features is going on at good pace (see https://webkit.org/status/>).

Post reply on HN