Back in 2019, I explained how browsers’ cookie controls and privacy features present challenges for common longstanding patterns for authentication flows. Such flows often rely upon an Identity Provider (IdP) having access to its own cookies both on top-level pages served by the IdP and when the IdP receives a HTTP request from an XmlHttpRequest/fetchContinue reading “Auth Flows in a Partitioned World”
Tag Archives: interop
Web Proxy Auto Discovery (WPAD)
Back in the mid-aughts, Adam G., a colleague on the IE team, used the email signature “IE Networking Team – Without us, you’d be browsing your hard drive.” And while I’m sure it was meant to be a bit tongue-in-cheek, it’s really true– without a working network stack, web browsers aren’t nearly as useful. BackgroundContinue reading “Web Proxy Auto Discovery (WPAD)”
A bit of GREASE keeps the web moving
For the first few years of the web, developers pretty much coded whatever they thought was cool and shipped it. Specifications, if written at all, were an afterthought. Then, for the next two decades, spec authors drafted increasingly elaborate specifications with optional features and extensibility points meant to be used to enable future work. Unfortunately,Continue reading “A bit of GREASE keeps the web moving”
META CHARSET
Someone complained that a Japanese page is garbled in Edge/Chrome, but renders with the correct characters in Firefox and IE: The problem is that Chromium is using an unexpected character set to interpret the response in the HTML Parser. That happens because the server doesn’t send a proper character set directive. To avoid problems likeContinue reading “META CHARSET”
Improving Privacy by Limiting Referrers
Updated July 31, 2020 to reflect changes planned to ship in Chrome 85 and Edge 86. As your browser navigates from page to page, servers are informed of the URL from where you’ve come from using the Referer HTTP header1; the document.referrer DOM property reveals the same information to JavaScript. Similarly, as the browser downloads theContinue reading “Improving Privacy by Limiting Referrers”
Surprise: Undead Session Cookies
I’ve been working on browsers professionally for 12 of the last 15 years, and in related areas for 20 of the last 20, and over the years I’ve discovered enough surprises in browser behavior that they’re no longer very surprising. Back in April, I wrote up a quick post explaining how easy it is toContinue reading “Surprise: Undead Session Cookies”
Edge79+ vs. Edge18 (Edge Legacy) vs. Chrome vs. Internet Explorer
Note: I expect to update this post over time. Last update: April 14, 2023. Compatibility Deltas As our new Edge Insider builds roll out to the public, we’re starting to triage reports of compatibility issues where Edge79+ (the new Chromium-based Edge, aka Anaheim) behaves differently than the old Edge (Edge18, aka Spartan, aka Edge Legacy)Continue reading “Edge79+ vs. Edge18 (Edge Legacy) vs. Chrome vs. Internet Explorer”
Private Browsing Mode
Note: This blog post was originally written before the new Chromium-based Microsoft Edge was announced. As a consequence, it includes discussion of the behavior of the Legacy Microsoft Edge browser. The new Chromium-based Edge behaves largely the same way as Google Chrome. Last Update: 12 Apr 2023 InPrivate Mode was introduced in Internet Explorer 8Continue reading “Private Browsing Mode”
Cookie Limits
I’ve been writing about Cookies a lot recently, and also did so almost a decade ago. Edge/IE cookie limits The June 1018 Cumulative Updates increased the per-domain cookie limit from 50 to 180 for IE and Edge Legacy across Windows 7, Windows 8.1, and Windows 10 (TH1 to RS2). This higher limit matches Chrome’s cookie jar. InContinue reading “Cookie Limits”
Edge Interop Issues
As we finish up the next release of Windows 10 (Fall 2018), my team is hard at work triaging incoming bugs. Many such bugs take the form “Edge does the wrong thing for this page. ${Other_Browser} works okay.” This post is designed to be an (ever-growing) index of some of the behavioral deltas that areContinue reading “Edge Interop Issues”