[blink-dev] Intent to Deprecate and Remove: WebSQL in third-party contexts

[Ari Chivukula]

Contact emails

ari...@chromium.org, jadek...@chromium.org, mike...@chromium.org

Specification

https://www.w3.org/TR/webdatabase/

Summary

We intend to deprecate and remove usage of WebSQL in third party contexts. Deprecation is targeted for M94 and removal is targeted for M97.

Blink component

Blink>Storage>WebSQL

Motivation

The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated this feature in 2019. The W3C encouraged those needing web databases to adopt Web Storage or Indexed Database.

We hope to entirely deprecate and remove WebSQL at some future point when usage is low enough.

TAG review

Not needed

Risks

Based on usage measurements rolled out in milestone 91 only 0.035% of page loads use WebSQL in a third party context. Further, only 0.02% of top sites have adopted this feature.

 

Interoperability and Compatibility

 

Gecko: Never implemented

 

WebKit: Deprecated in version 608 (Safari 13)

 

Web developers: No signals

 

Debuggability

Any attempt to use this feature will be flagged in the Issues tab.

Is this feature fully tested by web-platform-tests?

Not fully, one test checks the availability of the feature.

Tracking bug

https://crbug.com/1212491

Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5684870116278272

[Yoav Weiss]

On Thu, Jul 22, 2021 at 6:16 PM Ari Chivukula <ari...@chromium.org> wrote:

Contact emails

ari...@chromium.org, jadek...@chromium.org, mike...@chromium.org

Specification

https://www.w3.org/TR/webdatabase/

Summary

We intend to deprecate and remove usage of WebSQL in third party contexts. Deprecation is targeted for M94 and removal is targeted for M97.

Blink component

Blink>Storage>WebSQL

Motivation

The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated this feature in 2019. The W3C encouraged those needing web databases to adopt Web Storage or Indexed Database.

We hope to entirely deprecate and remove WebSQL at some future point when usage is low enough.

TAG review

Not needed

Risks

Based on usage measurements rolled out in milestone 91 only 0.035% of page loads use WebSQL in a third party context.

That's actually quite a lot. Do you have a sense of how the feature is used and what would breakage look like?

Looking at a sample of sites picked up by the HTTPArchive may reveal patterns that can help us get a better understanding of the risk here.

Further, only 0.02% of top sites have adopted this feature.

 

Interoperability and Compatibility

 

Gecko: Never implemented

 

WebKit: Deprecated in version 608 (Safari 13)

 

Web developers: No signals

 

Debuggability

Any attempt to use this feature will be flagged in the Issues tab.

Is this feature fully tested by web-platform-tests?

Not fully, one test checks the availability of the feature.

Tracking bug

https://crbug.com/1212491

Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5684870116278272

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAGpy5D%2BHiGthRBeCVMhL1PNdGyVaagRusPgFAnLkyF8J_gWm0g%40mail.gmail.com.

[Manuel Rego Casasnovas]

On 26/07/2021 12:32, Yoav Weiss wrote:
> WebKit: Deprecated in version 608 (Safari 13)

> <https://github.com/WebKit/WebKit/commit/761bce943c0696a6bb93116eb0576ed07dbfdc65>

That's a change related to WebKitGTK+ and WPE, where they marked the API
as deprecated.

Anyway it seems this was removed in Safari (at least on WebKit2, it
might be still available in WebKit1 though). See this thread:
https://lists.webkit.org/pipermail/webkit-dev/2019-November/030970.html
And also this commit:
https://trac.webkit.org/changeset/277564/webkit

Cheers,
Rego

[Ari Chivukula]

@manuel: Thanks for the corrected code pointer!

@yoav: The sample on the platform status page (https://www.chromestatus.com/metrics/feature/timeline/popularity/3865) highlighted a bunch of Hyundai dealerships, but when loading locally I'm unable to reproduce the creation of any WebSQL databases. I did find usage on https://accounts.mint.com/index.html, but when searching the scripts which created it I found that all checked if window.openDatabase even existed. The lack of support in Gecko and WebKit seems to have broken in the deprecation/removal codepath for us.

~ Ari Chivukula (Their/There/They're)

[Yoav Weiss]

So, you're saying that the usage we see is simply feature detection for the API and not real usage? Any way to add use counters that would confirm this?

[Ari Chivukula]

I'm saying something slightly different, that the usage I'm seeing is (1) checking for the existence of the function (instead of simply looking for if the engine is Blink) and (2) wrapping the subsequent call to opendatabase in a try statement (as per the spec which allows errors to be raised https://www.w3.org/TR/webdatabase/#databases). I think we're safe to (1) deprecate the function in third party contexts to alert developers to the change in M94 and then (2) raise SECURITY_ERR in a later milestone once we've completed outreach around M97 or later.

When I do (1) I could also add a counter into M94 which looks for actual usage of a created database beyond the feature detection we seem to be catching now.

~ Ari Chivukula (Their/There/They're)

[Yoav Weiss]

Deprecating in M94 while adding a usecounter sounds like a solid strategy. Please update this thread with the results from the usecounter once they are available.

LGTM1 to deprecate in M94 and remove support in M97, barring usecounter surprises.

[Chris Harrelson]

LGTM2

--

You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAL5BFfUCNvRNGQN7Oj6y7R2682KTv%3DgHis8nOSYs7Ne5q%2BHxBg%40mail.gmail.com.

[Alex Russell]

LGTM3 with the caveats Yoav outlines. Would like to hear back about the new usecounter data on this thread before 97 branch point.

Thank you for taking so much care with this deprecation.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

[Ari Chivukula]

Thanks for the feedback! I want to be sure I get to everything raised:

(1) Does your application depend on WebSQL usage in third-party contexts (i.e. in an iframe to a different origin)? If not, this deprecation/removal wouldn't apply, so I'll answer the rest of the questions assuming it does depend on third-party context WebSQL.

(2) Addressing Safari specifically: it's true a workaround existed in version 13 & 14 to disable the disable of WebSQL, but I believe that's been removed in version 15 (iOS15, macOS12, etc.) due this Fall. (If anyone has other information please speak up)

(3) As for adding a flag for third party WebSQL usage: it's possible something like that will be added based on usage (and feedback like this). However, any flag added would be a stop-gap to be removed entirely before all third-party storage is fully partitioned. There is no plan to support partitioning in WebSQL, the current plan is to fully remove it.

~ Ari Chivukula (Their/There/They're)

On Mon, Aug 9, 2021 at 4:47 AM Antonio Moreno <antonio...@openbravo.com> wrote:

Hi all,

I work as a developer in a complex business-oriented web application. This application used WebSQL as the main persistence API for a very long time. We knew that it was deprecated in the standard, and therefore we eventually migrated all our code to IndexedDb, and our latest releases do not use WebSQL at all.

However, some customers still use our previous versions, and we know that it will take some of them a significant amount of time to update to our newer release (in several cases we are talking for sure >1 year, in some it might be even more).

We would like to avoid using old versions of the browser while this happens, as we would be missing improvements and more importantly security updates. So my main question is, once the change is implemented, will it be possible via some flag to still use WebSQL temporarily in newer versions post M97?

I'm asking mainly because even though it was deprecated there, Safari still allows us to enable it back, so I was wondering if a similar feature will be available in Blink.

Thanks a lot in advance. Regards,

Antonio. 

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Ari Chivukula]

I'm glad that clarification helped!

(1) Yes, there will be no change to first-party WebSQL as a result of this intent.

(2) As for when first-party WebSQL will be deprecated/removed: I can't make any promises until a formal intent is sent out, but as this intent stated the plan is to deprecate/remove once usage is sufficiently low. Whereas this deprecation -> removal  was proposed to occur in 3 milestones (M94 -> M97), I would be shocked if WebSQL took fewer than 6 milestones, and would honestly expect more. Usage is still quite high, even on top sites: https://www.chromestatus.com/metrics/feature/timeline/popularity/10

~ Ari Chivukula (Their/There/They're)

On Mon, Aug 9, 2021 at 12:42 PM Antonio Moreno <antonio...@openbravo.com> wrote:

Hi Ari,

Thanks a lot for your response. To be honest, I had completely missed the "third party context" part. So this means that as long as we are creating/accessing the WebSQL database in the main domain the user is in, it will continue to be supported, at least for the time being?

If that is the case, then from our side we would be ok, our application should continue to work correctly.

Assuming that I'm correct, could you give a bit of visibility on how the team sees WebSQL going forward? Should we expect support for it to be dropped in short/mid term? Or do you anticipate the status-quo to be kept like this for a bit longer than that?

Finally, just as feedback from my side, if/when the team finally decides to fully remove support for WebSQL, it would be great if it was deprecated with a bit more time in advance so that we can warn our users with a bit more margin.

Thanks a lot for your information and insight!

Regards,

Antonio.

[Antonio Moreno]

Hi Ari,

Thanks a lot for your response. To be honest, I had completely missed the "third party context" part. So this means that as long as we are creating/accessing the WebSQL database in the main domain the user is in, it will continue to be supported, at least for the time being?

If that is the case, then from our side we would be ok, our application should continue to work correctly.

Assuming that I'm correct, could you give a bit of visibility on how the team sees WebSQL going forward? Should we expect support for it to be dropped in short/mid term? Or do you anticipate the status-quo to be kept like this for a bit longer than that?

Finally, just as feedback from my side, if/when the team finally decides to fully remove support for WebSQL, it would be great if it was deprecated with a bit more time in advance so that we can warn our users with a bit more margin.

Thanks a lot for your information and insight!

Regards,

Antonio.

On Monday, 9 August 2021 at 19:00:45 UTC+2 ari...@chromium.org wrote:

[Antonio Moreno]

Hi all,

I work as a developer in a complex business-oriented web application. This application used WebSQL as the main persistence API for a very long time. We knew that it was deprecated in the standard, and therefore we eventually migrated all our code to IndexedDb, and our latest releases do not use WebSQL at all.

However, some customers still use our previous versions, and we know that it will take some of them a significant amount of time to update to our newer release (in several cases we are talking for sure >1 year, in some it might be even more).

We would like to avoid using old versions of the browser while this happens, as we would be missing improvements and more importantly security updates. So my main question is, once the change is implemented, will it be possible via some flag to still use WebSQL temporarily in newer versions post M97?

I'm asking mainly because even though it was deprecated there, Safari still allows us to enable it back, so I was wondering if a similar feature will be available in Blink.

Thanks a lot in advance. Regards,

Antonio. 

On Thursday, 5 August 2021 at 21:21:40 UTC+2 sligh...@chromium.org wrote:

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Ari Chivukula]

Sorry for the delay, the data for actually reading/writing a database (as opposed to opening it) in a third party context ended up being nearly identical (0.03% of loads and about 10% of top-sites).

The code I spot checked still seems to gate usage of WebSQL on availability. That said, the change in M97 is linked to a feature flag so can be undone if there are issues in dev/beta. Also, there's an enterprise policy available to enable it (planned to exist until M102, when it'll be removed entirely and not simply disabled by default).

~ Ari Chivukula (Their/There/They're)

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Fernando Serboncini]

Given that we are disabling this for 3rd parties, would it make sense to already start warning 1st-party usage (saying that this doesn't work at all for 3rd parties and that it will be removed in the future)?

I don't know what's the guideline regarding having a deprecation warning without a clear milestone and also if it's reasonable to do a warning for a feature that has 1% usage. 

But I suggest this because:

1. the current behavior (only 1st party) may be a bit surprising, if not contextualized with "this feature is being deprecated".

2. early warning is better?

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAGpy5D%2BaQtspAhFrR1LUrvu2XZi58q4OhXV6G1kTjPO-P%3DuVmg%40mail.gmail.com.

[Ari Chivukula]

I agree with you, and hope we can soon make such an announcement (and add the warning for developers).

--

[Ari Chivukula]

We're gathering metrics to see how feasible deprecation is on different timelines and to determine the scope of outreach that would be necessary. Once that's done, if we move forward an intent to deprecate will be sent to blink-dev with the plan for comment before it's implemented. Some of this depends on how well the third-party WebSQL removal happening between M97 and M101 goes.

TL;DR No first-party WebSQL warning has been added and no plans are final.

~ Ari Chivukula (Their/There/They're)

On Thu, Nov 18, 2021, 23:04 Antonio Moreno <antonio...@openbravo.com> wrote:

Hi all,

Quick question, has this warning for first party contexts been finally added ? Or, otherwise, is there a decision on whether it will be finally added or not?

Thanks in advance, and regards,

Antonio.

[Antonio Moreno]

Hi Ari,

Very clear, thanks a lot for the information!

Regards,

Antonio.

[Antonio Moreno]

Hi all,

Quick question, has this warning for first party contexts been finally added ? Or, otherwise, is there a decision on whether it will be finally added or not?

Thanks in advance, and regards,

Antonio.

On Thursday, 28 October 2021 at 16:59:31 UTC+2 ari...@chromium.org wrote: