LGTM3
On 9/4/24 10:07 AM, Yoav Weiss (@Shopify) wrote:
LGTM2
On Wednesday, September 4, 2024 at 5:07:54 AM UTC+2 Domenic Denicola
wrote:
LGTM1. This seems like a good change for overall web consistency,
and compat risks seem well-managed.
On Thursday, August 29, 2024 at 4:32:20 AM UTC+9 Cammie Smith
Barnes wrote:
Intent to Ship: Shared Storage: Allowing Cross-Origin Script
in addModule & Aligning createWorklet
Contact emails
cam...@chromium.org, jkar...@chromium.org,
yao...@chromium.org, ashame...@google.com
Explainer
https://github.com/WICG/shared-storage/blob/main/README.md
<https://github.com/WICG/shared-storage/blob/main/README.md>
Specification
https://github.com/WICG/shared-storage/pull/161
<https://github.com/WICG/shared-storage/pull/161>
Summary
We now allow sharedStorage.worklet.addModule to load
cross-origin script, while still using the invoking
context's origin as the data partition origin for
accessing shared storage data. We also align the
behavior of sharedStorage.createWorklet, so that when
it loads a cross-origin script, it also uses the
invoking context's origin as the data partition origin
by default (instead of using the script origin as it
did when initially implemented). Finally, to preserve
the ability to use the script's origin as the data
partition origin, we introduce a new dataOrigin option
for createWorklet.
We have received feedback from developers stating they
wanted to be able to host and run their worklet script
on a separate origin from the origin that owns and
writes their shared storage data. So we remove the
same-origin restriction for addModule. Note that, when
the worklet script is cross-origin to the invoking
context, the invoking context's origin is used as the
partition origin for accessing shared storage.
To help avoid developer confusion in the long term, we
align the default behavior of createWorklet to use the
invoking context's origin instead of the script origin
as its data partition origin. This is a breaking
change, but current usage of createWorklet is low as
it was introduced in M125 and those that are using it
have upgraded to a forward-compatible incantation. We
also introduce a dataOrigin option that can be passed
to use the previous behavior.
Blink component
Blink>Storage>SharedStorage
<https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3EStorage%3ESharedStorage>
TAG review & status
Notification of the change is here
<https://github.com/w3ctag/design-reviews/issues/747#issuecomment-2288670353>but
not expecting feedback as the entire Shared Storage
feature is resolved as unsatisfied.
Risks
Interoperability and Compatibility
There are no interop risks as no other browser has
implemented shared storage. There is a compat risk for
the recently released createWorklet API. The worklet
created by createWorklet before this change had the
data partition of the script’s origin. We’re changing
it, to align with addModule, to use the calling
context’s origin instead. We’re monitoring usage here
<https://chromestatus.com/metrics/feature/timeline/popularity/5007>of
the backwards-incompatible usage of the existing API
and reaching out to folks using it to let them know
that they should make the following forward-compatible
change if they want the existing default behavior of
createWorklet to continue to function after this change:
before: sharedStorage.createWorklet(worklet_url);
after: sharedStorage.createWorklet(worklet_url, {
dataOrigin: “script-origin” });
The dataOrigin option will be ignored on browsers
previous to this change, and honored correctly after.
As of today, all users have switched to the
forward-compatible incantation. We are also monitoring
usage of addModule with scripts that are cross-origin
to the calling context here
<https://chromestatus.com/metrics/feature/timeline/popularity/5028>,
as those will suddenly work when they did not before
which could be surprising to developers. As
anticipated, this usage is extremely low (.00001% page
loads).
Gecko: Negative on shared storage
WebKit: Negative on shared storage
Web developers: Positive, but there is follow-up work
to allow createWorklet() to serve the script from a
different origin than the data origin which is what
folks ultimately want. That change will be
non-breaking. This work is a first step in that
direction (allowing addModule to be cross-origin).
Other signals:
WebView application risks
Does this intent deprecate or change behavior of
existing APIs, such that it has potentially high risk
for Android WebView-based applications?
None
Debuggability
Shared Storage worklets can be debugged in devtools.
Will this feature be supported on all six Blink
platforms (Windows, Mac, Linux, ChromeOS, Android, and
Android WebView)?
All but webview
Is this feature fully tested by web-platform-tests
<https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?
Yes
Flag name on chrome://flags
None
Finch feature name
SharedStorageCrossOriginScript and
SharedStorageCreateWorkletUseContextOriginByDefault
Non-finch justification
NA
Requires code in //chrome?
False
Estimated milestones
M130
Anticipated spec changes
None
Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/6531477832204288?gate=6576220452683776
<https://chromestatus.com/feature/6531477832204288?gate=6576220452683776>
Links to previous Intent discussions
Intent to Prototype:
https://groups.google.com/a/chromium.org/g/blink-dev/c/YZ4XGewKVuk/m/v8CwKfq8AAAJ?utm_medium=email&utm_source=footer
<https://groups.google.com/a/chromium.org/g/blink-dev/c/YZ4XGewKVuk/m/v8CwKfq8AAAJ?utm_medium=email&utm_source=footer>
This intent message was generated by Chrome Platform
Status <https://chromestatus.com/>.
--
You received this message because you are subscribed to the Google
Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to blink-dev+unsubscr...@chromium.org.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/c0f43188-c7a0-4603-8796-9ecc04eacfe9n%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/c0f43188-c7a0-4603-8796-9ecc04eacfe9n%40chromium.org?utm_medium=email&utm_source=footer>.
--
You received this message because you are subscribed to the Google Groups
"blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to blink-dev+unsubscr...@chromium.org.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/dd7f46c4-9f83-4e1f-a020-69e4541ad123%40chromium.org.