yoavweiss

Currently, HTML's fetch a single module script stored a permanent null entry in the module map whenever a module fetch failed. Because the module map is consulted before any module-related network activity, every later import() of that same (URL, module type) pair failed immediately, without a re-fetch, for the entire lifetime of the Document or worker.

That meant that a single transient failure was unrecoverable short of a full page reload (or a cache-busting URL such as import(url + "#retry1")).

This change removes entries from the module map upon network or status code failure (but not parse failure), enabling explicit developer-triggered retries (e.g. using import()) to take place.

There is no new API surface, only a behavior change.

This is only web exposed through the fact that previously-failed module fetches now issue a network request instead of immediately failing again.

yoavweiss

Security & Privacy Self-Review Questionnaire

Feature: Avoid caching module failures (don't cache HTTP errors in the module map)

Summary for reviewers

This change removes a permanent negative cache entry from an in-memory, per-realm map. It adds no API surface, exposes no information to any party, adds no persistent state, adds no fingerprinting entropy, and relaxes no security check — every retried fetch is re-validated in full against CSP, CORS, SRI, mixed content, and module type constraints. Successful loads and parse errors remain cached, so no time-of-check/time-of-use hazard is introduced. The only new observable is that an author-initiated repeated import may issue a network request, which pages can already do with fetch(). It has shipped in Gecko and WebKit and is covered by web-platform-tests.

| | |

yoavweiss

Security & Privacy Self-Review: moderate_viewport_heuristics

This document answers the questions from the W3C TAG Self-Review Questionnaire: Security and Privacy for the proposed moderate_viewport_heuristics extension to Speculation Rules.

Feature summary

Chromium's "moderate" eagerness speculation rules on mobile use a viewport-based heuristic to pick at most one on-screen link to prefetch/prerender each time the user stops scrolling. The heuristic has three tunable parameters:

• distance_from_pointer_down — a [low, high] band, as a fraction of screen height, gating how far a candidate link may be from the user's last pointerdown.
• largest_anchor_threshold — how much larger (by visible area) the largest candidate must be than the runner-up before it is chosen.

yoavweiss

Self-Review Questionnaire: Security and Privacy

Feature: Exposing redirectCount (and redirectStart / redirectEnd) on PerformanceNavigationTiming for TAO opted-in cross-origin redirect chains.

Specs:

• HTML: whatwg/html#12513
• Fetch: whatwg/fetch#1931
• Issue: w3c/navigation-timing#215

---

yoavweiss

"moderate" speculation rules eagerness proves very useful on desktop, but less so on mobile.

Chromium's current mobile heuristics are based on watching the viewport: when a link scrolls into view and looks like a plausible next click, the browser prefetches or prerenders it. This shipped in Chrome 138; there's more background in the blink-dev PSA.

"Looks like a plausible next click" comes down to three checks the browser runs

yoavweiss

Self-Review Questionnaire: Security and Privacy

styleDuration, layoutDuration, forcedStyleDuration, and forcedLayoutDuration attributes

Answers to the W3C Security and Privacy Self-Review Questionnaire for the newly added timing duration attributes in the Long Animation Frames API.

These attributes break down existing aggregate timing into finer-grained style and layout components:

• PerformanceLongAnimationFrameTiming.styleDuration / layoutDuration: Time spent in style recalculation and layout during the rendering phase of a long animation frame.
• PerformanceScriptTiming.forcedStyleDuration / forcedLayoutDuration: Time spent in synchronous (forced) style recalculation and layout triggered during script execution (e.g., by calling getComputedStyle() or getBoundingClientRect()).

yoavweiss

const totalStyleCost = async () => {
  return new Promise(resolve => {
    let total = 0;
    const obs = new PerformanceObserver(entryList => {
      const entries = entryList.getEntries();
      for (const entry of entries) {
          if (entry.paintTime) {
              total += entry.paintTime - entry.styleAndLayoutStart;
          } else {
              total += entry.startTime + entry.duration - entry.styleAndLayoutStart;

yoavweiss

Participants

Yoav Weiss

Rouslan Solomakhin (Google)

Darwin Yang (Google)

(Shopify)

yoavweiss

WICG: Address Autofill

• TPAC

Attendees: Westin, Martin Lechner, Yoav Weiss, Anne van Kesteren, Christian Indra, Rick Byers, Adam Rice, Michal Mocny, Dominic Batre

• Yoav: Discuss Address Autofill
• autofill is a key feature for login and web forms etc

yoavweiss

Joel: Welcome! Gonna show a live use case for FedCM

Demo to bootstrap the conversation

Shop.app is the buyer-facing identity at Shopify

Reaching checkout when you’re not authenticated can be complicated

Buyers that reach checkout authenticated, they’re more likely to successfully complete checkout