Empty Accept-CH being used to clear Client Hint requests about client-hints-infrastructure

[arichiv]

There aren’t plans to deprecate or remove the empty Accept-CH method.

I’m already working on the first part of the PR here: w3c/webappsec-clear-site-data#74

[arichiv]

Closing out as this is implemented in chrome M117 by default.

[yoavweiss]

^^ @arichiv @miketaylr

[arichiv]

Accept-CH (like Critical-CH) is an sf-list, and those are only valid to split across multiple lines as long as each line has at least one token: https://www.rfc-editor.org/rfc/rfc8941.html#name-lists

The current behavior, ignoring all Accept-CH headers if you send a blank one and others that aren’t blank, is correct unless we define our own sort of list and merging logic.

This is noted in the spec currently: “There MAY be multiple Accept-CH headers per-response and sf-lists can be split across lines as long as each line contains at least one token.”

[arichiv]

I could see moving to option 3 or 5 potentially, @miketaylr for thoughts.

We technically shouldn’t ever be asking for an empty sf-list anyway, so it would be more compliant to have an independent header and ignore the empty case entirely (or slate it for deprecation).

[miketaylr]

Option 5 makes sense to me semantically, though the Clear-Site-Data spec is in a bit of a sad unmaintained state right now (someone on my team had volunteered to pick that up, but it never happened). I also wonder if other vendors would object since none of them support CH yet...

[arichiv]

I could take a look and consider taking it up. Will get back within a week or so.

[arichiv]

Have been thinking this over, and I realized that if the user deletes cookies from the UI we clear client hint data but that (as least as far as I can see) when cookies are deleted via this header that doesn't happen. It seems like we want to consider:
(1) adding a clientHints option to Clear-Site-Data
(2) updating the cookies option to also clear client hints

@yoavweiss for thoughts

[yoavweiss]

I think that clearing either cookies or cache using Clear-Site-Data should clear the CH cache as well (and tbh, I thought we did that already).

[miketaylr]

I think that clearing either cookies or cache using Clear-Site-Data should clear the CH cache as well

I like this idea.

[nicjansma]

Sounds reasonable to us as well!

Would Accept-CH: (empty) still continue to work (clearing all hints), either as an "official" way of clearing Hints, or as a not-official-but-it-just-has-that-side-effect of it being an empty list?

I would recommend (and can offer a PR, if desired) this repo have a dedicated section in the docs about Clear-Site-Data and the official (and/or not recommended) Accept-CH: way of clearing hints.

[arichiv]

https://groups.google.com/a/chromium.org/g/blink-dev/c/lJY86eTPQ0s the proposal is under review