Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 90 supports Fetch Metadata Request Headers

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 109 posts

Re: Firefox 90 supports Fetch Metadata Request Headers

#51

Post by Ajedi32 »

twsted wrote: post #30
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago: 1. it was largely dominant, so people thought they could develop just taking that browser in consideration 2. for the previous point, MS started to develop proprietary features (like ActiveX) 3. at a certain point its development was stopped for a long time Saf…

Those might be the reasons why users disliked IE, but the reason developers dislike IE were/are somewhat different:

1. It doesn't support many of the latest web standards

2. A large enough percentage of users use it that it can't be simply ignored

Both of those points apply to modern Safari. Less so to IE these days as #2 becomes less and less applicable; hence "Safari is the new IE".

Re: Firefox 90 supports Fetch Metadata Request Headers

#53

Post by rrdharan »

Cyph0n wrote: post #22
dathinab wrote: post #8

Earlier quoted context omitted.

Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…

> supper-seeded I think you meant superseded (pronounced super-seeded).

Fascinating, TIL that superseded is correct and superceded is and has been wrong for four hundred years :):

https://www.merriam-webster.com/dictionary/supercede

Re: Firefox 90 supports Fetch Metadata Request Headers

#54

Post by ddworken »

barbazoo wrote: post #52

In the example, couldn't the call from attacker.com to banking.com be thwarted by CORS headers defined by the server?

In the web, requests are made in either `cors` mode or `no-cors` mode. In `cors` mode, the `Origin` header is sent in the request. So yes, in `cors` mode the server could reject the request based on the `Origin` header. But in `no-cors` mode (the default if you do something like ``) the `Origin` header isn't set, so CORS doesn't help defend against any attacks.

Re: Firefox 90 supports Fetch Metadata Request Headers

#55

Post by ddworken »

TazeTSchnitzel wrote: post #46

Does this essentially solve XSRF? Would it no longer be necessary to use XSRF tokens?

One other notable candidate for essentially "solving" XSRF is SameSite cookies:

https://web.dev/samesite-cookies-explained/

SameSite cookies are supported in Safari and IE11, so they're potentially a better candidate, but there are still come caveats (see here for some of them: https://security.stackexchange.com/questions/234386/do-i-sti...).

Re: Firefox 90 supports Fetch Metadata Request Headers

#56

Post by reader_mode »

twsted wrote: post #30
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago: 1. it was largely dominant, so people thought they could develop just taking that browser in consideration 2. for the previous point, MS started to develop proprietary features (like ActiveX) 3. at a certain point its development was stopped for a long time Saf…

Developers hated having to work around missing features for IE even when FF and Chrome took over the market, Safari is the exact same, except you can't even update the rendering engine on iOS, Apple doesn't want webapps to eat away at app store profit (notice how shitty and slow moving the webgl/webgpu thing has been mostly due to iOS Safari)

Re: Firefox 90 supports Fetch Metadata Request Headers

#57

Post by ec109685 »

This is FUD:

> Hence the banking server or generally web application servers will most likely simply execute any action received and allow the attack to launch.

While these are useful headers, there are protections today via XSRF tokens to prevent these attacks that all major sites implement, so it isn’t likely your bank is vulnerable.

Re: Firefox 90 supports Fetch Metadata Request Headers

#58

Post by will4274 »

userbinator wrote: post #14
dathinab wrote: post #9

Earlier quoted context omitted.

If site producers want to it's already pretty much impossible today. At least without some "tricks", and nothing prevents your video-downloader from just adding a header which pretend it's origin is a website. (Or more funny you inject the downloading JS code into the website in question extending it with a download functionality ;=) ).

There's a difference between only allowing that behaviour, and explicitly creating features to enable it. This sounds like Referer, but worse.

? Referer contains tracking information. This doesn't..

Re: Firefox 90 supports Fetch Metadata Request Headers

#59

Post by [deleted] »

alexghr wrote: post #49
TazeTSchnitzel wrote: post #46

Does this essentially solve XSRF? Would it no longer be necessary to use XSRF tokens?

I think they could replace XSRF tokens, but until all major browsers support the headers (Safari 11 seems to be missing support, see other comments) you can't really block requests that don't have the new Sec-Fetch-* headers.

[deleted]
Post reply on HN