Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Intent to Deprecate and Remove: Expect-CT in Google Chrome #2666

Open
capegreg opened this issue Oct 5, 2022 · 2 comments
Open

Intent to Deprecate and Remove: Expect-CT in Google Chrome #2666

capegreg opened this issue Oct 5, 2022 · 2 comments

Comments

@capegreg
Copy link

capegreg commented Oct 5, 2022

bootstrap-datepicker should no longer include Expect-CT in response header.

https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datepicker/1.9.0/js/bootstrap-datepicker.min.js

Reproduction:

Save html as test.html and open in Chrome browser.

<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Document</title>	
</head>
<body>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datepicker/1.9.0/css/bootstrap-datepicker.min.css">
<input type="text" name="Date1" data-provide="datepicker" 
data-date-autoclose="true" data-range-ordinal="1" data-type="date" value="" data-date-format="mm/dd/yyyy" todayhighlight="true" data-date-clear-btn="true">
<ul>
	<li class="items1">Open Chrome Developer tools</li>
	<li class="items2">Click Network</li>
	<li class="items3">Select bootstrap-datepicker.min.js</li>
	<li class="items4">Click Headers, scroll down to expect-ct</li>
</ul>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.0/jquery.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap-datepicker/1.9.0/js/bootstrap-datepicker.min.js"></script>
</body>
</html>

Result:

Response Headers include expect-ct:

expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

Intent to Deprecate and Remove: Expect-CT
https://groups.google.com/a/chromium.org/g/blink-dev/c/bGLVLwSKNJY/m/nbg4hWckAwAJ

"Expect-CT was designed to help transition to universal Certificate Transparency (CT) enforcement, by allowing high-value websites to opt in to CT enforcement/reporting for better security before CT enforcement was required (by Chrome) on all public websites. However, Expect-CT has now outlived its usefulness. Chrome requires CT on all public websites now, so there is no security value to Expect-CT anymore. Expect-CT was also designed to help site owners discover CT-related misconfigurations; however, now that CT is universally required, CT is generally configured in websites' certificates by certificate authorities and virtually never configured by individual site owners, thus Expect-CT has very limited value as a misconfiguration/debugging tool anymore either. No other browser has implemented Expect-CT so removing it is not an interoperability concern."

Deprecated: This feature is no longer recommended
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT
@martin-juul
Copy link

This is a cloudflare issue.

@capegreg
Copy link
Author

capegreg commented Nov 29, 2022 •
edited

Thanks. The expect-ct header can be removed from this library by emailing Cloudflare support. I have switched my includes to using local build in lieu of cdnjs, so it's not an issue for me any longer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@capegreg @martin-juul