Intent to Deprecate: Deprecate unload event
Fergal Daly
Contact emails
fer...@chromium.org, kenji...@chromium.org
Explainer
https://github.com/fergald/docs/blob/master/explainers/permissions-policy-deprecate-unload.md
Specification
https://github.com/whatwg/html/pull/7915
Summary
A Permission-Policy for creating unload event listeners will be added.
Initially, the default policy will be set to allow. From there, Chrome will gradually migrate the default policy to deny (i.e. increasingly disallow the creation of unload event listeners, eventually reaching a state where deny fully becomes the default policy). The ultimate goal is to remove support for unload event.
Blink component
Motivation
The unload event is extremely unreliable. It is ignored in most cases by all mobile browsers except Firefox on Android. Furthermore, in Safari, the unload event is ignored on both desktop & mobile platforms.
In the current state, unload is a major BFCache blocker (~18 percentage points reduction of hit rate for Chrome).
The change will unlock a large fraction of that hit-rate while providing an opt-out for those who need more time to migrate. It also sends a clear signal that unload should not be used in new development.
Sidenote: the spec was changed to say that unload should only run if the page cannot enter BFCache, which reflects Safari’s behavior, However neither Chrome nor Mozilla have implemented this behavior. In Chrome's case, we believe that this would suddenly break various sites and would make it hard for developers to know if/when unload may run.
Initial public proposal
None
TAG review
https://github.com/w3ctag/design-reviews/issues/738
TAG review status
Pending
Risks
Interoperability and Compatibility
If no other browsers implement this, there is a risk that devs continue to use unload widely and pages malfunction on chrome. However given that alternatives to unload exist it seems entirely possible for sites that are actively maintained to move off unload.
Gecko: (https://github.com/mozilla/standards-positions/issues/691#issuecomment-1484997320) It's possible that pages are depending on `unload` handlers in subframes for functionality even without any main frame navigation. We should try to understand how common this is before breaking it. It should be possible to measure how often subframe unloads fire when the mainframe is not navigating. This will give us an upper bound on the size of the problem, - Chrome: we have landed code to measure the occurrence of unload in different scenarios. We will report back the findings.
WebKit: https://github.com/WebKit/standards-positions/issues/127
Web developers: Positive (https://groups.google.com/a/chromium.org/g/bfcache-dev/c/zTIMx7u4uxo/m/-M4IS6LDBgAJ) The web communities we reached out had positive reactions to our proposal and we have not heard about any concrete blockers.
Other signals:
WebView application risks
Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?
On WebView, we will introduce the Permissions-Policy but not move the default to "deny". BFCache does not work on WebView, so the benefit is lower. Meanwhile the risk seems higher as we have far less visibility into the HTML being run in WebViews. A roll-out to WebView should be done independently and in consultation with the WebView team.
Debuggability
None
Is this feature fully tested by web-platform-tests?
Yes
Flag name
None
Requires code in //chrome?
False
Estimated milestones
M115 for availability of Permissions-Policy
M115 is the earliest we would start to disable unload, however
Link to entry on the Chrome Platform Status
Rick Byers
Summary
A Permission-Policy for creating unload event listeners will be added.
Initially, the default policy will be set to allow. From there, Chrome will gradually migrate the default policy to deny (i.e. increasingly disallow the creation of unload event listeners, eventually reaching a state where deny fully becomes the default policy). The ultimate goal is to remove support for unload event.
Blink component
Motivation
The unload event is extremely unreliable. It is ignored in most cases by all mobile browsers except Firefox on Android. Furthermore, in Safari, the unload event is ignored on both desktop & mobile platforms.
In the current state, unload is a major BFCache blocker (~18 percentage points reduction of hit rate for Chrome).
The change will unlock a large fraction of that hit-rate while providing an opt-out for those who need more time to migrate. It also sends a clear signal that unload should not be used in new development.
Sidenote: the spec was changed to say that unload should only run if the page cannot enter BFCache, which reflects Safari’s behavior, However neither Chrome nor Mozilla have implemented this behavior. In Chrome's case, we believe that this would suddenly break various sites and would make it hard for developers to know if/when unload may run.
Initial public proposal
None
TAG review
https://github.com/w3ctag/design-reviews/issues/738
TAG review status
Pending
Risks
Interoperability and Compatibility
If no other browsers implement this, there is a risk that devs continue to use unload widely and pages malfunction on chrome. However given that alternatives to unload exist it seems entirely possible for sites that are actively maintained to move off unload.
Gecko: (https://github.com/mozilla/standards-positions/issues/691#issuecomment-1484997320) It's possible that pages are depending on `unload` handlers in subframes for functionality even without any main frame navigation. We should try to understand how common this is before breaking it. It should be possible to measure how often subframe unloads fire when the mainframe is not navigating. This will give us an upper bound on the size of the problem, - Chrome: we have landed code to measure the occurrence of unload in different scenarios. We will report back the findings.
WebKit: https://github.com/WebKit/standards-positions/issues/127
Web developers: Positive (https://groups.google.com/a/chromium.org/g/bfcache-dev/c/zTIMx7u4uxo/m/-M4IS6LDBgAJ) The web communities we reached out had positive reactions to our proposal and we have not heard about any concrete blockers.
Other signals:
WebView application risks
Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?
On WebView, we will introduce the Permissions-Policy but not move the default to "deny". BFCache does not work on WebView, so the benefit is lower. Meanwhile the risk seems higher as we have far less visibility into the HTML being run in WebViews. A roll-out to WebView should be done independently and in consultation with the WebView team.
Requires code in //chrome?
False
Estimated milestones
M115 for availability of Permissions-Policy
M115 is the earliest we would start to disable unload, however
Link to entry on the Chrome Platform Status
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAozHLm7CR6EeL2KmBFyFpYT%3DNPXmTg4roLKV%3D7dRcCE%2BOoGwg%40mail.gmail.com.
Rick Byers
Kenji Baheux
- Enterprise/Edu environments: the default behavior will be controllable via a dedicated group policy (i.e. admins will have the option to opt-out), and we have drafted a heads-up in the next Chrome for Enterprise release notes.
- Killswitch wise, the default behavior will be controlled via finch flag(s).
Fergal Daly
Hi Fergal,It's exciting to see this moving forward! Just to clarify, this is effectively an I2S for the unload permissions-policy, is that right? Or are you also requesting permission to stop firing unload events now too? The latter is going to require some significant compat analysis, but could be greatly informed by the experience of having some top-level sites opt-out of unload for their frame tree.
Any plan to trigger a deprecation warning / report for the installation of unload handlers? It might be tricky to find a good balance of useful warnings without being too spammy.
A couple more questions / comments inline:On Mon, May 8, 2023 at 7:43 AM Fergal Daly <fer...@chromium.org> wrote:This is still marked as draft. Can you get this ready for review? If it's blocked only on having a 2nd implementor show support, then I'd be fine shipping based on a PR. But we should at least do what we can to solicit feedback on the spec change prior to shipping.
Summary
A Permission-Policy for creating unload event listeners will be added.
Initially, the default policy will be set to allow. From there, Chrome will gradually migrate the default policy to deny (i.e. increasingly disallow the creation of unload event listeners, eventually reaching a state where deny fully becomes the default policy). The ultimate goal is to remove support for unload event.
Blink component
Motivation
The unload event is extremely unreliable. It is ignored in most cases by all mobile browsers except Firefox on Android. Furthermore, in Safari, the unload event is ignored on both desktop & mobile platforms.
In the current state, unload is a major BFCache blocker (~18 percentage points reduction of hit rate for Chrome).
The change will unlock a large fraction of that hit-rate while providing an opt-out for those who need more time to migrate. It also sends a clear signal that unload should not be used in new development.
Sidenote: the spec was changed to say that unload should only run if the page cannot enter BFCache, which reflects Safari’s behavior, However neither Chrome nor Mozilla have implemented this behavior. In Chrome's case, we believe that this would suddenly break various sites and would make it hard for developers to know if/when unload may run.
Initial public proposal
None
TAG review
https://github.com/w3ctag/design-reviews/issues/738
TAG review status
Pending
Risks
Interoperability and Compatibility
If no other browsers implement this, there is a risk that devs continue to use unload widely and pages malfunction on chrome. However given that alternatives to unload exist it seems entirely possible for sites that are actively maintained to move off unload.
Gecko: (https://github.com/mozilla/standards-positions/issues/691#issuecomment-1484997320) It's possible that pages are depending on `unload` handlers in subframes for functionality even without any main frame navigation. We should try to understand how common this is before breaking it. It should be possible to measure how often subframe unloads fire when the mainframe is not navigating. This will give us an upper bound on the size of the problem, - Chrome: we have landed code to measure the occurrence of unload in different scenarios. We will report back the findings.
WebKit: https://github.com/WebKit/standards-positions/issues/127
From a quick skim, it sounds like WebKit is already happy with their tradeoff of not firing unload and doesn't see a need for an API that reduces unload further, is that about right? WebKit has mostly shipped heuristics here without trying to spec them first, right? In general I'm not too concerned
Web developers: Positive (https://groups.google.com/a/chromium.org/g/bfcache-dev/c/zTIMx7u4uxo/m/-M4IS6LDBgAJ) The web communities we reached out had positive reactions to our proposal and we have not heard about any concrete blockers.
Other signals:
WebView application risks
Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?
On WebView, we will introduce the Permissions-Policy but not move the default to "deny". BFCache does not work on WebView, so the benefit is lower. Meanwhile the risk seems higher as we have far less visibility into the HTML being run in WebViews. A roll-out to WebView should be done independently and in consultation with the WebView team.
Sounds like the right strategy to me, thanks!Debuggability
None
Is this feature fully tested by web-platform-tests?
Yes
Flag name
None
Please put the new policy behind a RuntimeEnabledFeature. It's effectively a new API so is required to have a finch killswitch. It sounds to me like it should be unlikely that simply adding the new policy could break things, but maybe some scenario is possible where we decide breakage in 3p iframes is bad enough to warrant an emergency fix?
Requires code in //chrome?
False
Estimated milestones
M115 for availability of Permissions-Policy
M115 is the earliest we would start to disable unload, however
Is this a typo? Or are you considering disabling the event in the same release we first make the permissions policy available?
Fergal Daly
Hi API-owners,
I am now asking for permission to go ahead with the following concrete unload deprecation plan below.
Tools and outreach
M115 Enable `Permission-Policy: unload` (PP:unload) with the default being enabled. This allows sites to opt-in to unload deprecation.
Outreach to 1st/3rd parties, to migrate away from using unload and to enforce this with PP:unload.
Deprecation
M117 change the default for PP:unload so that unload handlers are skipped by default for 1% of page loads
M118 increase to 5% of page loads
M119 (last of 2023) increase to 10% of page loads
Evaluate progress on reduction of the use of unload
M120-128 increase +10% gradually to 100% of page loads
Enterprise policy would allow opt-out entirely.
Obviously, the deprecation timeline is contingent on unload usage coming down in response to the earlier steps.
We expect that 10% of page loads will provide a noticeable signal to sites that use unload. Also, if we were to just follow the current spec and not run unload when we can BFCache (as happens on Clank/Firefox mobile and all WebKit) we expect that we would skip 30-40% of unload handlers when the main frame navigates.
Decisions:
Timeline
All navigations vs main-frame navigations only
Standardising
We have some new data and have had some further discussions with browser vendors. There's no consensus. TL;DR WebKit are opposed to any Permissions-Policy but support removing unload eventually. Mozilla are still discussing.
Both Mozilla and WebKit were opposed to standardising `Permissions-Policy: unload` (defaulting to on) because they worried that a containing frame might selectively disable unload handlers in a child frame for malicious purposes (no specific cases were discussed).
So we flipped to the idea of having PP:unload with the default being disabled. We cannot suddenly do that. We need to roll it out gradually. WebKit folks are opposed to this and have suggested we do a reverse origin trial instead. If our plan works out, eventually we would ROT as the final nail but ROT starting now has downsides for users and sites and no upside for the implementer.
Mozilla has so far not been negative on the Permissions-Policy off-by-default approach but they are still discussing. They are concerned that disabling unloads when subframes are navigating could be a problem. We found that about 1/4 of subframe navigations involve an `unload` handler (most seem to involve handlers in cross-site and same-site site frames). We don't have examples of sites that rely on `unload` handlers in this way, although they probably do exist. Migrating to `pageshow` or using PP:unload for these sites should be trivial.
We have the option to say that PP:unload only applies to main frame navigations. This would mean these sites would be completely unaffected however that has some downsides. It is harder to explain and does not end with full removal of `unload`. We would prefer to have this apply to all navigations unless we find a good reason not to. If we were to change part-way, there would be no breakage. We hope that once we drive down usage in 3rd-part iframes with PP:unload that the number of unload handlers running in subframe navigations decreases significantly.
Finally there was some discussion about how Permissions-Policy off-by-default should work. Our current version requires every page to set the header and every parent to set the iframe `allow` attribute. This is maximally conservative. If at some point later on there is agreement to standardise on something less conservative, it will not break pages that have already re-enabled `unload`.
Overall it seems hard to standardise in advance but if we succeed in driving down `unload` usage, other browsers are on-board with removing unload. The worst case scenario would be where we implement PP:unload (which the others do not agree with) but make no noticeable progress on `unload` usage. If that happens we can just go with the currently specced behaviour (don't run `unload` if BFCaching is possible) and maybe revert the PP:unload,
Rick Byers
Daisuke Enomoto
Fergal Daly
Hi Fergal,
Thanks for pushing through this contentious and challenging deprecation. We discussed this in the API owners meeting today and were worried that this plan seemed likely to be seriously problematic for enterprises (policy opt-out is helpful, but far from a silver bullet unfortunately). To what extent have you engaged with them and worked to follow the enterprise breaking change policy? Our hunch is that at 1% or 5% we'd get escalations forcing us to abandon this plan. Of course, if the enterprise team is OK with it, we could always try anyway and see if our hunch is right. It's possible I'm over-indexing on past experiences like deprecating sync XHR in unload handlers and that the enterprise world is different now, but I doubt it :-).
In general Yoav and I disagree with the WebKit and Gecko feedback here and suspect that your original PP default-on proposal is far more likely to be a successful deprecation path for Chrome (and, should they choose to follow, Edge). I can understand why Firefox and WebKit don't have the same constraints around enterprises and so would choose differently for themselves. Yoav and I are happy to help in the standards discussions. I'm about to go on vacation for 2 weeks but Yoav said he'd follow up with you privately to brainstorm next steps. Sound good?
Mike Taylor
Hi Fergal,
Nice to have lunch with you today.
Hi API-owners,
I am now asking for permission to go ahead with the following concrete unload deprecation plan below.
Tools and outreach
M115 Enable `Permission-Policy: unload` (PP:unload) with the default being enabled. This allows sites to opt-in to unload deprecation.
Outreach to 1st/3rd parties, to migrate away from using unload and to enforce this with PP:unload.
Deprecation
M117 change the default for PP:unload so that unload handlers are skipped by default for 1% of page loads
M118 increase to 5% of page loads
M119 (last of 2023) increase to 10% of page loads
Evaluate progress on reduction of the use of unload
M120-128 increase +10% gradually to 100% of page loads
Enterprise policy would allow opt-out entirely.
Obviously, the deprecation timeline is contingent on unload usage coming down in response to the earlier steps.
Can you spell out a bit more what you're thinking here? I wouldn't expect much movement when enabled at only 1% (but maybe y'all are super good at outreach and will prove me wrong) - it's very likely losing 1% of unload handlers is hard to notice or reproduce (my hunch is that "breakage" here is subtle, and in the form of missing analytics/pings, etc.). 5% is probably a big enough dent to notice, maybe?
I would almost recommend getting to 5% faster than M119 - that's
just a few weeks out from November holidays where many sites go
into code freeze ahead of Black Friday™.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAozHLnTtwL9jbt0gyS%3DDouUk2yzsHrmgmF7YaDasb-%2B706EOQ%40mail.gmail.com.
Kenji Baheux
On Thu, 29 Jun 2023 at 01:16, Rick Byers <rby...@chromium.org> wrote:Hi Fergal,Thanks for pushing through this contentious and challenging deprecation. We discussed this in the API owners meeting today and were worried that this plan seemed likely to be seriously problematic for enterprises (policy opt-out is helpful, but far from a silver bullet unfortunately). To what extent have you engaged with them and worked to follow the enterprise breaking change policy? Our hunch is that at 1% or 5% we'd get escalations forcing us to abandon this plan. Of course, if the enterprise team is OK with it, we could always try anyway and see if our hunch is right. It's possible I'm over-indexing on past experiences like deprecating sync XHR in unload handlers and that the enterprise world is different now, but I doubt it :-).In addition to Daisuke's response... are you concerned about enterprises that are not using fleet management and so cannot use the opt-out? If you think an enterprise policy will not be sufficient, a mitigation for those enterprises would be for us to publish an extension that allows anyone to re-enable unload (for all sites or for specific sites) by injecting the PP:unload header. Are the escalations that can't be resolved by either a policy or extension?
In general Yoav and I disagree with the WebKit and Gecko feedback here and suspect that your original PP default-on proposal is far more likely to be a successful deprecation path for Chrome (and, should they choose to follow, Edge). I can understand why Firefox and WebKit don't have the same constraints around enterprises and so would choose differently for themselves. Yoav and I are happy to help in the standards discussions. I'm about to go on vacation for 2 weeks but Yoav said he'd follow up with you privately to brainstorm next steps. Sound good?I would love to get moving on PP:unload ASAP no matter what. It's been through OT and is sitting behind a flag with some sites eager to use it. I'm happy to send an I2S for that while we discuss the harder problem. We hope that getting that out there can clear out a large chunk of the 1st- and 3rd-party unload usage,
Fergal Daly
Hi Fergal,
Nice to have lunch with you today.
On 6/28/23 5:06 PM, 'Fergal Daly' via blink-dev wrote:
Hi API-owners,
I am now asking for permission to go ahead with the following concrete unload deprecation plan below.
Tools and outreach
M115 Enable `Permission-Policy: unload` (PP:unload) with the default being enabled. This allows sites to opt-in to unload deprecation.
Outreach to 1st/3rd parties, to migrate away from using unload and to enforce this with PP:unload.
Deprecation
M117 change the default for PP:unload so that unload handlers are skipped by default for 1% of page loads
M118 increase to 5% of page loads
M119 (last of 2023) increase to 10% of page loads
Evaluate progress on reduction of the use of unload
M120-128 increase +10% gradually to 100% of page loads
Enterprise policy would allow opt-out entirely.
Obviously, the deprecation timeline is contingent on unload usage coming down in response to the earlier steps.
Can you spell out a bit more what you're thinking here? I wouldn't expect much movement when enabled at only 1% (but maybe y'all are super good at outreach and will prove me wrong) - it's very likely losing 1% of unload handlers is hard to notice or reproduce (my hunch is that "breakage" here is subtle, and in the form of missing analytics/pings, etc.). 5% is probably a big enough dent to notice, maybe?
I would almost recommend getting to 5% faster than M119 - that's just a few weeks out from November holidays where many sites go into code freeze ahead of Black Friday™.
Rick Byers
On Thu, Jun 29, 2023 at 1:48 PM Fergal Daly <fer...@google.com> wrote:On Thu, 29 Jun 2023 at 01:16, Rick Byers <rby...@chromium.org> wrote:Hi Fergal,Thanks for pushing through this contentious and challenging deprecation. We discussed this in the API owners meeting today and were worried that this plan seemed likely to be seriously problematic for enterprises (policy opt-out is helpful, but far from a silver bullet unfortunately). To what extent have you engaged with them and worked to follow the enterprise breaking change policy? Our hunch is that at 1% or 5% we'd get escalations forcing us to abandon this plan. Of course, if the enterprise team is OK with it, we could always try anyway and see if our hunch is right. It's possible I'm over-indexing on past experiences like deprecating sync XHR in unload handlers and that the enterprise world is different now, but I doubt it :-).In addition to Daisuke's response... are you concerned about enterprises that are not using fleet management and so cannot use the opt-out? If you think an enterprise policy will not be sufficient, a mitigation for those enterprises would be for us to publish an extension that allows anyone to re-enable unload (for all sites or for specific sites) by injecting the PP:unload header. Are the escalations that can't be resolved by either a policy or extension?One extra comment on the extension option (great for desktop).If you wonder about the mobile BYOD scenarios, where extensions don't exist, then we are a bit lucky here because unload is already unreliable on mobile. So, it seems extremely unlikely that we'd see mobile enterprise/edu products that rely on unload on mobile.Rick: are there specific scenarios / environments that we haven't covered?
In general Yoav and I disagree with the WebKit and Gecko feedback here and suspect that your original PP default-on proposal is far more likely to be a successful deprecation path for Chrome (and, should they choose to follow, Edge). I can understand why Firefox and WebKit don't have the same constraints around enterprises and so would choose differently for themselves. Yoav and I are happy to help in the standards discussions. I'm about to go on vacation for 2 weeks but Yoav said he'd follow up with you privately to brainstorm next steps. Sound good?I would love to get moving on PP:unload ASAP no matter what. It's been through OT and is sitting behind a flag with some sites eager to use it. I'm happy to send an I2S for that while we discuss the harder problem. We hope that getting that out there can clear out a large chunk of the 1st- and 3rd-party unload usage,+1, I'd suggest doing that regardless.There are a few large sites that have done some legwork on unload handlers (theirs and third party partners), and are interested in pushing the remaining unload handlers out with PP:unload. Having allies in the ecosystem (i.e. extra incentives to migrate), will be helpful going forward :)
Brandon Heenan
Hello, I'm chiming in to provide some thoughts from the enterprise perspective.
Our goal is to not block forward progress to the web, but to improve the web in an enterprise-friendly way. You shouldn't ever hear me say "you can't do X because it's scary to the enterprise team." You should instead hear "We expect X to be risky, but here are the things we know we can do to make it much less risky."
In this case, yes, this is risky for enterprises. We can say this with confidence because we've seen escalations before when we've made changes to unload events (crbug.com/933153, crbug.com/953228).
Kenji and Daisuke have been working with us, and my understanding of the plan is to:
Allow developers to opt-in early to the new behavior (unload event ignored) with a permission policy
Communicate the change on chromestatus and the enterprise release notes (already happening). We will provide a bug link for customers for feedback in a future release.
Reach out to enterprises and developers we expect to be affected
Introduce an enterprise policy to allow an IT admin to control unload event behavior
Introduce a flag in chrome://flags/deprecated to allow end users to control unload event behavior
As early as M117, change the default for the policy so that unload events will be ignored. This is the breaking change, and there's likely to be friction here. The two escalations mentioned above both resulted in respins the first time they reached this point. However, this time around, IT admins will be able to fix their environment immediately with the enterprise policy, end users will be able to fix themselves with the deprecation flag, and developers will be able to fix their app with the permission policy. With those mitigations in place, the risk of requiring a respin (or Finch rollback) due to enterprise impact is dramatically reduced, and this is how we eventually successfully shipped both of those above escalations.
We expect a long transition period after that. By default, the unload event is ignored, but different stakeholders are able to revert to legacy behavior. Within enterprise, we expect the enterprise policy to be the most useful mitigation, and the deprecation flag is the backup for BYOD or unmanaged devices. For the above escalations, this migration period was over a year, and I'm expecting something similar this time.
At some point in the future, we expect to remove those mitigations and remove support for the unload event completely. We don't have any specific dates for that yet; we will be responsive to the needs of web stakeholders, enterprise and otherwise.
The two escalations I mentioned above were successfully resolved and the changes to not allow popups on page unload and to not allow synchronous XHRs on page unload were shipped. Both of those changes followed essentially the same plan I just laid out above, and so I think it's reasonable to do the same thing here.
Yoav Weiss
- Third party widgets that currently use unload to send a single "end of page" beacon. fetchLater() is aiming to be that replacement, but it's not ready just yet.
- Enterprise SAAS providers that don't have direct and immediate control over their customers' application configuration, nor on their users' Enterprise Policy.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/d955dd04-7aac-462a-bd85-d69df8d7d86bn%40chromium.org.
Robert Knight
Rick Byers
Hello,Hypothesis (https://web.hypothes.is, a web page/PDF/ebook annotation tool) uses the "unload" event to signal to one end of a message channel when the other end is in a frame that is about to go away. This is a workaround for the lack of a "close" event in the Channel Messaging API (https://github.com/whatwg/html/issues/1766). If unload events are going to be removed from the web platform, it would be useful to have a proper solution for detecting when a MessagePort becomes disconnected ("disentangled").
Kind Regards,Robert KnightOn Monday, 10 July 2023 at 08:13:49 UTC+1 Yoav Weiss wrote:Thanks for chiming in, Brandon!I'm glad to hear that the Enterprise constituency is comfortable with the plan.I'm concerned that there may be a couple other constituencies that may not be:I think that a short-lived 3P deprecation trial may address these constituencies as well. Would you consider adding that to your plans?
- Third party widgets that currently use unload to send a single "end of page" beacon. fetchLater() is aiming to be that replacement, but it's not ready just yet.
- Enterprise SAAS providers that don't have direct and immediate control over their customers' application configuration, nor on their users' Enterprise Policy.
On Sat, Jul 8, 2023 at 12:55 AM 'Brandon Heenan' via blink-dev <blin...@chromium.org> wrote:Hello, I'm chiming in to provide some thoughts from the enterprise perspective.
Our goal is to not block forward progress to the web, but to improve the web in an enterprise-friendly way. You shouldn't ever hear me say "you can't do X because it's scary to the enterprise team." You should instead hear "We expect X to be risky, but here are the things we know we can do to make it much less risky."
In this case, yes, this is risky for enterprises. We can say this with confidence because we've seen escalations before when we've made changes to unload events (crbug.com/933153, crbug.com/953228).
Kenji and Daisuke have been working with us, and my understanding of the plan is to:
Allow developers to opt-in early to the new behavior (unload event ignored) with a permission policy
Communicate the change on chromestatus and the enterprise release notes (already happening). We will provide a bug link for customers for feedback in a future release.
Reach out to enterprises and developers we expect to be affected
Introduce an enterprise policy to allow an IT admin to control unload event behavior
Introduce a flag in chrome://flags/deprecated to allow end users to control unload event behavior
As early as M117, change the default for the policy so that unload events will be ignored. This is the breaking change, and there's likely to be friction here. The two escalations mentioned above both resulted in respins the first time they reached this point. However, this time around, IT admins will be able to fix their environment immediately with the enterprise policy, end users will be able to fix themselves with the deprecation flag, and developers will be able to fix their app with the permission policy. With those mitigations in place, the risk of requiring a respin (or Finch rollback) due to enterprise impact is dramatically reduced, and this is how we eventually successfully shipped both of those above escalations.
We expect a long transition period after that. By default, the unload event is ignored, but different stakeholders are able to revert to legacy behavior. Within enterprise, we expect the enterprise policy to be the most useful mitigation, and the deprecation flag is the backup for BYOD or unmanaged devices. For the above escalations, this migration period was over a year, and I'm expecting something similar this time.
At some point in the future, we expect to remove those mitigations and remove support for the unload event completely. We don't have any specific dates for that yet; we will be responsive to the needs of web stakeholders, enterprise and otherwise.
The two escalations I mentioned above were successfully resolved and the changes to not allow popups on page unload and to not allow synchronous XHRs on page unload were shipped. Both of those changes followed essentially the same plan I just laid out above, and so I think it's reasonable to do the same thing here.
Greg Whitworth
2. Will sendBeacon still work when navigating to another page?
Rick Byers
Hey folks,Salesforce hasn't had a chance to do a full scan yet but we can almost guarantee we'll have this somewhere. We do have two questions that we'd like answered:
1. Are you also removing the beforeunload event?
2. Will sendBeacon still work when navigating to another page?
Ian Clelland
On Thu, Jul 27, 2023 at 11:37 AM Greg Whitworth <gregcwh...@gmail.com> wrote:Hey folks,Salesforce hasn't had a chance to do a full scan yet but we can almost guarantee we'll have this somewhere. We do have two questions that we'd like answered:Thanks Greg! I imagine it's going to be quite hard to know where unload handlers are critical vs. unimportant, so perhaps the most important thing is for us to coordinate on the experimentation and opt-out plan. To what extent do you feel comfortable that the opt-out mechanisms the team have described (permissions policy, enterprise policy, and worst case a user setting) will be adequate for you to manage any disruption?I'll attempt to answer your questions on behalf of the team since it's night time in Tokyo now. But I'm sure Fergal / Kenji can add more color later.1. Are you also removing the beforeunload event?No. We discourage use of beforeunload due to bfcache impact on Firefox, it doesn't prevent bfcache on Chrome.2. Will sendBeacon still work when navigating to another page?Yes it should, sendBeacon is one of the features designed to eliminate dependency on the unload event.
Fergal Daly
On Thu, Jul 27, 2023 at 1:38 PM Rick Byers <rby...@chromium.org> wrote:On Thu, Jul 27, 2023 at 11:37 AM Greg Whitworth <gregcwh...@gmail.com> wrote:Hey folks,Salesforce hasn't had a chance to do a full scan yet but we can almost guarantee we'll have this somewhere. We do have two questions that we'd like answered:Thanks Greg! I imagine it's going to be quite hard to know where unload handlers are critical vs. unimportant, so perhaps the most important thing is for us to coordinate on the experimentation and opt-out plan. To what extent do you feel comfortable that the opt-out mechanisms the team have described (permissions policy, enterprise policy, and worst case a user setting) will be adequate for you to manage any disruption?I'll attempt to answer your questions on behalf of the team since it's night time in Tokyo now. But I'm sure Fergal / Kenji can add more color later.1. Are you also removing the beforeunload event?No. We discourage use of beforeunload due to bfcache impact on Firefox, it doesn't prevent bfcache on Chrome.
2. Will sendBeacon still work when navigating to another page?Yes it should, sendBeacon is one of the features designed to eliminate dependency on the unload event.Adding to that, a new fetchLater API (originally PendingBeacon) is being developed by the team in parallel to specifically solve the problem of sending beacons on page unload. Rather than relying on an unload event, it will let you register a beacon earlier, to be sent at the point where the user navigates away or closes the page.
Fergal Daly
Hello,Hypothesis (https://web.hypothes.is, a web page/PDF/ebook annotation tool) uses the "unload" event to signal to one end of a message channel when the other end is in a frame that is about to go away. This is a workaround for the lack of a "close" event in the Channel Messaging API (https://github.com/whatwg/html/issues/1766). If unload events are going to be removed from the web platform, it would be useful to have a proper solution for detecting when a MessagePort becomes disconnected ("disentangled").
Robert Knight
Robert Knight
Fergal Daly
Hello, I'm chiming in to provide some thoughts from the enterprise perspective.
Our goal is to not block forward progress to the web, but to improve the web in an enterprise-friendly way. You shouldn't ever hear me say "you can't do X because it's scary to the enterprise team." You should instead hear "We expect X to be risky, but here are the things we know we can do to make it much less risky."
In this case, yes, this is risky for enterprises. We can say this with confidence because we've seen escalations before when we've made changes to unload events (crbug.com/933153, crbug.com/953228).
Kenji and Daisuke have been working with us, and my understanding of the plan is to:
Allow developers to opt-in early to the new behavior (unload event ignored) with a permission policy
Communicate the change on chromestatus and the enterprise release notes (already happening). We will provide a bug link for customers for feedback in a future release.
Reach out to enterprises and developers we expect to be affected
Introduce an enterprise policy to allow an IT admin to control unload event behavior
Introduce a flag in chrome://flags/deprecated to allow end users to control unload event behavior
Brandon Heenan
Fergal Daly
Flipping the permission policy default is still a breaking change that requires some action from the developer to keep unload events, right? If so, we still want en entry in the /deprecated page so that unmanaged (vendors/BYOD/outbound) users accessing on-prem deployments have some mitigation. Kenji and I discussed this case with SAP last week, and that level of mitigation seemed necessary.
Brandon Heenan
Fergal Daly
Still, previous breaking changes to the unload event that affected SAP were present in the /deprecated page, so the safest thing to do is to follow the same pattern here, no?
Fergal Daly
> Robert, in your case could you use the permission policy to re-enable unload events on the frame until we come up with a better fix? Or are there scenarios where you lack the ability to add "allow=" attributes to the iframe elements?If I understand correctly, this attribute has to be set before the frames load?
Brandon Heenan
Fergal Daly
That makes sense—I suppose a more general wording that would apply here would be "These flags prevent or revert a breaking change and will only be available for a limited time." Does that sound better to you / others on the thread?
Brandon Heenan
Srđan
Fergal Daly
Hi Blink API owners,
We would like to get approval to start doing a limited experiment on deprecating unload handlers, proposal below. First some updates.
MessagePorts
After some investigation, it turns out that Robert Knight (Hypothesis)'s use of `unload` to signal that a MessagePort can be closed can be replaced with `pagehide` since the navigation in question are always in subframes. More generally, signalling like this is not a reliable way to handle this. Use of WeakRefs or combining with WeakRefs will capture all occurrences. The full details are in this explainer which proposes to add an explicit event for this. Firefox have already said they would implement it. Implementing it isn't a blocker for unload, the explainer documents how to do it with WeakRefs, however it is a nice-to-have.
Other use cases
Nobody else has raised any problematic use cases.
Enterprise
We are discussing with enterprise software vendors, how to make the deprecation easier for them, in particular for their on-premises customers.
We have added an enterprise policy that allows enterprises to disable the deprecation (leave the default as enabled) for their managed devices. There is also a chrome://flags/deprecated flag for BYOD.
We are considering a 3rd-party deprecation-trial. That would likely be ready in M119 (there are some implementation issues that make it non-trivial).
The discussions are ongoing.
Proposal
We would like to go ahead in M118 with the following - deprecate unload (by changing the permissions policy default) for 1% of users on a limited allowlist of hosts. This would be for a limited set of hosts (top N hosts by traffic in UKM for a value of N that may increase as we gather data). This will avoid enterprise vendor instances while still allowing us to get started with the deprecation,
Mike Taylor
Hi Fergal,
Just to clarify - are you only requesting to deprecate at 1% for M118 (and presumably report back on findings), or for M118+ and then eventually request to go higher?
thanks,
Mike
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAozHLkZO%3DMhhOSqdBqyT47_t0O6eOaA1AmqYD%3Diru7f0sarmw%40mail.gmail.com.
Rick Byers
Mike Jackson
-Michael
Fergal Daly
Hi Fergal,
Just to clarify - are you only requesting to deprecate at 1% for M118 (and presumably report back on findings), or for M118+ and then eventually request to go higher?
Fergal Daly
I like the 1% experiment for top N hosts approach, that seems well balanced for risk/reward while also fair to the industry. Is that ranked by all page loads, or by something else (like number of page loads with an unload handler)?
Fergal Daly
I believe that the original idea was that the deprecation would start with M117, but changed to M118?
Shodai2023年9月11日月曜日 9:56:04 UTC+9 Fergal Daly:
池邊正大
On Fri, 8 Sept 2023 at 23:19, Mike Taylor <mike...@chromium.org> wrote:
Mike Taylor
LGTM1 to deprecate at 1% for M118+. Please return and report on
your findings - whether that was "we had to turn it off because
$REASON", or "we would like to go to N% based on $REASON". In my
experience, it's hard for sites to observe the effects of a 1%
experiment, but we have to start somewhere. :)
thanks,
Mike
Yoav Weiss
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/1d6f3fd9-6154-4cfd-b7f4-c7c75be7f5fd%40chromium.org.
Fergal Daly
LGTM2 (although I'm not sure it's needed - are we considering this an experiment?)
Fergal Daly
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAozHLkZO%3DMhhOSqdBqyT47_t0O6eOaA1AmqYD%3Diru7f0sarmw%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.
Chris Harrelson
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAozHLkZO%3DMhhOSqdBqyT47_t0O6eOaA1AmqYD%3Diru7f0sarmw%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/1d6f3fd9-6154-4cfd-b7f4-c7c75be7f5fd%40chromium.org.
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/520cf5f5-e30f-456a-ac41-ddecfdbdca50n%40chromium.org.
Fergal Daly
Mike Taylor
No concerns, thanks for the update Fergal.
Fergal Daly
Rick Byers
Ian Clelland
Disabling unload by default with a deprecation trial and permission policy control to opt-back-in on the top 50 sites sounds good to me as the next step in the experiment. Even at 100%, I consider this a small fractional experiment due to applying only to the top 50 sites (even if that's more than 1% usage - from a developers impacted perspective it's tiny). Obviously we'll still have to be prepared to flip this off in the case of significant breakage reports. So LGTM.Personally I think ramping up the top-N site value is a better roll-out strategy for this feature than using fractional user deployment as it reduces the risk of confusing developers with hard-to-reproduce breakage.Thanks for all your diligence and effort here!RickOn Fri, Jun 14, 2024 at 1:24 AM Fergal Daly <fer...@google.com> wrote:TL;DR:- no feedback from running at 1% on top-50 sites- asking for agreement on some further changes to handle some edge cases- asking for LGTM to roll out beyond 1% of top-50 sitesFrom 2024-04-02 until 2024-05-20 we were at 1% of the top 50 sites having unload disabled by default. We received no feedback.During this time I figured out some exception cases that were missing from the original proposal. They are documented here TL;DR- frameset frames, <embed> and <object> will inherit their parent's unload policy directly as they have no `allow` attribute.- documents without headers (e.g. "about:blank", "data:...") will behave as if they had their parent's header (the `allow` attribute will still be a factor)These are not specific to unload. Both of these seem like necessary exceptions for any attempt to deprecate a feature by using a default-none Permissions-Policy.