Intent to Implement: Deprecation Reports, ReportingObserver

[Paul Meyer]

Contact emails

paul...@chromium.org, rby...@chromium.org

 

Spec

https://github.com/WICG/reporting/blob/master/EXPLAINER.md#basic-report-formats

Summary

These features are closely related to the previously proposed Reporting API. Deprecation reports are one type of report be routed into the Reporting API backend. ReportingObserver is a new observer that will allow developers to observe reports from JavaScript.

See this explainer for more details.

 

Motivation

Deprecation reports will indicate to developers that a feature they are using (and may be relying on) is expected to stop working in a future update.

ReportingObserver will provide a convenient method for developers to be informed of reports from within a page's JavaScript. This observer could be used either in addition to or instead of the delivery of reports via the Reporting API.

 

Interoperability and Compatibility Risk

No change in existing behavior so compatibility risk should be very low. For interoperability risk, we've been discussing the design primarily with pat...@microsoft.com on the Edge team, who is supportive. We've also got positive feedback from web developers at Facebook and Akami, and are talking with Google web teams who want to use this too.

Discussions:

https://github.com/WICG/reporting/issues/27

https://github.com/WICG/reporting/issues/29

 

Ongoing technical constraints

None.

 

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes.

 

OWP launch tracking bug

crbug.com/731810

 

Link to entry on the feature dashboard

https://www.chromestatus.com/feature/4691191559880704

 

Requesting approval to ship?

No.

[Emily Stark]

I want to register one compat/security concern regarding the Reporting API, which is the issue of CORS preflights.

Reporting API reports are technically supposed to trigger CORS preflights, because they are cross-origin requests with non-whitelisted Content-Type header values. This has been under discussion in various places for a while now, both in spec and implementation, for the Reporting API and for a bunch of other features. But I don't think there is yet a clear conclusion or short-term path for implementing preflights for the Reporting API.

So, I just want to register this as an open issue. If we ship the Reporting API without preflights, then we will have a security concern (how do we justify that these requests are safe even though they violate CORS?) and also a possible compat issue (if we want to ship preflights later on, we risk breaking report-collection servers that do not expect preflights).

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAGa%2B4ojE7C-HeTSFyfM-mXsL149OVORfbO73_sFKPCfuEy73nQ%40mail.gmail.com.

[Johnny Stenback]

+1 to not shipping more relaxed behavior if it can at all be avoided. Tightening things up down the road could turn out to be extremely difficult.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAPP_2SbmhNBGfjpTVRT61s3r0-piz0xsu5aw71AaKtFOTr4TUA%40mail.gmail.com.

[Rick Byers]

Sorry for the delay, just wanted to say thanks for bringing this concern up here and mention that I think issues in reporting API like this can be decoupled from the features discussed in this intent (deprecation reports and ReportingObserver).  I.e. our ship coupling should be:

• Shipping ReportingObserver is blocked on having at least one customer generating observable reports
• Shipping Reporting API is blocked on having at least one customer generating reports
• Deprecation reports is blocked on shipping EITHER ReportingObserver or Reporting API

Any concerns?

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CACZRgz4AiJR4P7kFhmcGRRTiAK5pNOZ9b9%2BObJ5q2O%3D7bVHmtA%40mail.gmail.com.

[Julia Tuttle]

Do you intend for deprecation reports to count as one of those customers? That is, can we satisfy that dependency graph by shipping Reporting Observer (or API) and deprecation reports *together*?

[Rick Byers]

Yes exactly.

There's little value to shipping an API to see reports without anything generating reports, and no value to generating reports without any API to see them.  But either API for seeing reports is valuable on it's own.