{"id":4479,"date":"2017-07-21T13:03:39","date_gmt":"2017-07-21T17:03:39","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=4479"},"modified":"2017-07-24T02:37:20","modified_gmt":"2017-07-24T06:37:20","slug":"secure-contexts-features-chrome","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/secure-contexts-features-chrome\/","title":{"rendered":"All \u201cSecure Contexts\u201d Only Features In Chrome"},"content":{"rendered":"

Complete List of HTTPS-Only Features in Chrome<\/h2>\n

In order to keep users secure, Chrome has restricted a number of features to \u201csecure origins\u201d only. On the web, this usually means the feature is only available if your website uses HTTPS. <\/span><\/p>\n

This is part of an initiative by google known as \u201cDeprecating Powerful Features on Insecure Origins<\/a>.\u201d In plain language this means that browser features which access your device (e.g. local storage, microphone) or sensitive user data can only be used with a secure connection.<\/p>\n

This applies to both existing features\/APIs and new ones. Some features, such as the Google-championed Service Worker API were designed with the expectation that they can only be used securely.<\/p>\n

\u201cSecure origins\u201d or \u201csecure contexts\u201d include a variety of schemes and hosts. The most popular of these would be HTTPS and localhost<\/em>. All secure origins are defined here<\/a> by Google. There is also a W3C candidate specification defining secure context<\/a> for those that like to read internet standards.<\/p>\n

For many of these features a specific removal date\/version has not been given. This is because Chrome\u2019s developers look at real-world use of these features and may decide to delay removal until developers are ready. In general, they like to wait until insecure use of a feature drops below 0.03% of all page loads before removing a feature\u2019s ability to work on insecure origins.<\/p>\n

Keeping track of the details can be a bit difficult, so we put together a list of features already restricted to secure origins and which ones are on the chopping block.<\/p>\n

Powerful Features? What are they?<\/h2>\n

What makes a feature powerful?<\/p>\n

According to Google\u2019s definition<\/a> it is any feature which \u201chandle personally-identifiable information… handle high-value information like credentials or payment instruments…[or] provide the origin with control over the UA’s trustworthy\/native UI, access to sensors on the user’s device, or generally any feature that we would provide a user-settable permission or privilege to.\u201d<\/p>\n

In a Wired interview<\/a> from last year, one of Chrome\u2019s security leads explained that in order \u201cto compete with mobile apps,\u201d Google wants \u201cwants web pages to be able to reach deeper into your computer’s resources, accessing the same sensitive infor\u00admation, like location and offline data, that apps routinely use. But if the web’s tendrils are going to extend further into our private lives, they first need to be secure.\u201d That involves a number of initiatives to make Chrome safer, and securing powerful features is one of them.<\/p>\n

Note that the below list of powerful features will grow over time. Any feature which would require the user to grant permission is a good candidate for a powerful feature.<\/p>\n

\"Google<\/p>\n

Check back with this document as it will be updated as Google releases new information. Please leave a comment if you have any questions on features you may be concerned about or need clarity on.<\/p>\n

Secure Origin-Only Features<\/h2>\n

These are features that are currently restricted to HTTPS or other secure origins.<\/p>\n\n\n\n\n\n\n\n\n\n
Feature\/API<\/strong><\/td>\nWhen?<\/strong><\/td>\nNotes<\/strong><\/td>\n<\/tr>\n
getUserMedia<\/p>\n

(Webcam and Microphone)<\/td>\n

Version 47<\/a><\/p>\n

~December 2015<\/td>\n

<\/td>\n<\/tr>\n
Geolocation<\/td>\nVersion 50<\/a><\/p>\n

~April 2016<\/td>\n

Announcement post.<\/a><\/p>\n

 <\/p>\n

Google Developer\u2019s announcement<\/a>.<\/td>\n<\/tr>\n

EME<\/p>\n

(Encrypted Media Extension)<\/td>\n

Version 58
\n~April 2017<\/td>\n		Announcement post<\/a>.<\/p>\n

Chrome Bug Tracker<\/a>.<\/td>\n<\/tr>\n

Service Workers<\/td>\nVersion 40
\n<\/a>~January 2015<\/td>\n		Has required HTTPS since it\u2019s initial introduction.<\/td>\n<\/tr>\n
Web Bluetooth<\/td>\nVersion 56
\n<\/a>~January 2017<\/td>\n		Has required HTTPS since it\u2019s initial introduction.<\/td>\n<\/tr>\n
WebCrypto<\/td>\nVersion 37
\n<\/a>~August 2014<\/td>\n		Has required HTTPS since it\u2019s initial introduction.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Future Changes<\/h2>\n

These are features which will be restricted to HTTPS or other secure origins in upcoming versions of Chrome.<\/p>\n\n\n\n\n\n\n\n
Feature\/API<\/strong><\/td>\nWhen?<\/strong><\/td>\nNotes<\/strong><\/td>\n<\/tr>\n
Application Cache<\/p>\n

(AppCache)<\/td>\n

N\/A<\/td>\nAppCache in its entirety is deprecated and no longer recommended<\/a>, even over HTTPS.<\/p>\n

 <\/p>\n

The Cache API<\/a>, which is part of Service Workers<\/a>, should be used instead.<\/p>\n

 <\/p>\n

In Chrome, the AppCache API has been deprecated since the release of Version 52 in July 2016<\/a> but it has not yet been removed.<\/td>\n<\/tr>\n

Device Motion \/ Orientation<\/td>\nN\/A<\/td>\n<\/td>\n<\/tr>\n
Fullscreen<\/td>\nN\/A<\/td>\n<\/td>\n<\/tr>\n
Notifications<\/td>\nVersion 61<\/p>\n

~September 2017<\/td>\n

Official platform status<\/a>.<\/p>\n

Console warning currently shown when using<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Additional Resources<\/h2>\n

These may help…<\/p>\n

Permission.site<\/a> is a webpage that allows you to test a variety of powerful and permission-gated features over HTTP and HTTPS.<\/p>\n","protected":false},"excerpt":{"rendered":"

Complete List of HTTPS-Only Features in Chrome In order to keep users secure, Chrome has restricted a number of features to \u201csecure origins\u201d only. On the web, this usually means…<\/p>\n","protected":false},"author":2,"featured_media":4483,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[17],"tags":[131,155,3527],"class_list":["post-4479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-lowdown","tag-google","tag-google-chrome","tag-permissions","post-with-tags"],"views":19411,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/07\/iStock-689019766.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=4479"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4479\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/4483"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=4479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=4479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=4479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}