The design of AppCache brings many problems to the web platform from a
performance and security perspective. Service workers have long solved the
same use cases as AppCache.
Removal of this code would bring a large reduction of code and complexity
that is largely unmaintained.
History
Four years ago, in Firefox 44, we marked the API as deprecated[1].
Back last year in Firefox 62, we disabled insecure AppCache and Chrome
followed suit[2].
Safari 11.1 added support for Service Workers, which are a replacement
technology [3].
Metrics
Chrome measures a few different metrics here which suggest 2.3%[4] of
secure page loads attempt to use the document visible API whilst only
0.27%[5] actually use the offline cache.
Firefox metrics suggest around 0.01% of pages are using an AppCache[6]
however we don’t have a distinct metric for the API usage.
The last blocker for a removal was usage of AppCache by some Microsoft
online products. I’m enquiring into if this is still applicable and also
want to ensure with this rollout plan that we don’t break these when the
user has an online connection.
Implementation
Bug where the code will be implemented[7].
Plan
-
In Firefox 70, Remove the previous preference
“browser.cache.offline.insecure.enable” and related code, forcing all of
the APIs to only ever be available over Secure Contexts despite user
choice. Due to the insecure nature of insecure context AppCache it is a
good time now to remove this fully.
-
Create a new preference that disables only the storage and use of
AppCache data whilst permitting access to the dom property
window.applicationCache and the “OfflineResourceList” interface.
-
Disable access in Nighty and beta for 70 for two releases before
disabling for all other releases in 72.
-
Once storage is disabled in all releases:
-
Disable the API access in Nightly and beta via the existing
preference (browser.cache.offline.enable) in version 72.
-
Wait two releases and then disable in all releases in Firefox 74.
This staged removal of AppCache is to reduce the risk of web compatibility
issues of the API being accessible to page scripts. Despite the API
presence it won’t have any ability to use the cache. We may look into
shimming these APIs depending on how the rollout plan goes.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1204581
[2]
https://groups.google.com/forum/#!msg/mozilla.dev.platform/qLTTpdzcDkw/WKJeq-4HAQAJ
[3]
https://developer.apple.com/library/archive/releasenotes/General/WhatsNewInSafari/Articles/Safari_11_1.html
[4] https://www.chromestatus.com/metrics/feature/timeline/popularity/1248
[5] https://www.chromestatus.com/metrics/feature/timeline/popularity/1246
[6] https://mzl.la/2TKRbvA
[7] https://bugzilla.mozilla.org/show_bug.cgi?id=1237782
_______________________________________________
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform
