Intent to ship: PerformanceServerTiming

[Valentin Gosu]

Bug 1423495 <https://bugzilla.mozilla.org/show_bug.cgi?id=1423495> is set
to land on m-c and we intend to let it ride the release train, meaning we
are targeting Firefox 61.

Chromium bug: https://bugs.chromium.org/p/chromium/issues/detail?id=702760

This affects web-compat, since per our "restrict new features to secure
origins policy" the serverTiming attribute will be undefined on unsecure
origins.
There is a bug on the spec to address this issue:
https://github.com/w3c/server-timing/issues/54

Link to the spec: https://w3c.github.io/server-timing/

[James Graham]

What's the wpt test situation for this feature, and how do our results
compare to other browsers?

[Valentin Gosu]

The WPT tests pass when run over HTTPS:
https://w3c-test.org/server-timing/test_server_timing.html

[James Graham]

On 24/04/2018 22:36, Valentin Gosu wrote:
> On 24 April 2018 at 22:44, James Graham <ja...@hoppipolla.co.uk

<https://bugs.chromium.org/p/chromium/issues/detail?id=702760>

>
> This affects web-compat, since per our "restrict new features to
> secure
> origins policy" the serverTiming attribute will be undefined on
> unsecure
> origins.
> There is a bug on the spec to address this issue:
> https://github.com/w3c/server-timing/issues/54
> <https://github.com/w3c/server-timing/issues/54>
>
> Link to the spec: https://w3c.github.io/server-timing/
> <https://w3c.github.io/server-timing/>
>
>
> What's the wpt test situation for this feature, and how do our
> results compare to other browsers?
>
>
> The WPT tests pass when run over HTTPS:
> https://w3c-test.org/server-timing/test_server_timing.html

If we are only supporting this in secure contexts, we should rename the
test so that it has .https. in the filename which will cause it to be
loaded over https when run (e.g. in our CI). If there is general
agreement about restricting the feature to secure contexts, we should
additionally add a test that it doesn't work over http.

I can't imagine this would be controversial, but if it is we should at
least ensure that there's a copy of the test set up to run over https.

[Boris Zbarsky]

On 4/25/18 8:12 AM, James Graham wrote:
> If there is general agreement about restricting the feature to secure contexts

There is not. Given the discussion in the spec issue, I fully expect
Chrome to ship it in all contexts.

-Boris