Forum Moderators: open

Message Too Old, No Replies

SharedArrayBuffers and Chrome

         

nomis5

4:15 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I received the message below from Google Search Console Team. Anyone any idea what it means?

"New requirements for SharedArrayBuffers on [xxxxxxxxxxx.co.uk...]
Google systems have recently detected that SharedArrayBuffers (SABs) are used on [xxxxxxxxxxxx.co.uk...] but COOP and/or COEP headers are not served.
For web compatibility reasons, Chrome is planning to require COOP/COEP for the use of SABs from Chrome 91 (2021-25-05) onwards. Please implement 'cross-origin-isolated' behaviour on your site."

NickMNS

4:26 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Here is an explanation of SharedArrayBuffers:
[developer.mozilla.org...]

My guess is that you are using a plugin or widget that is using webGL to render content, and webGL is using the SAB's.

The easy fix, would be to add the COOP/COEP headers, see the security section in the mozilla link above for details.

nomis5

4:45 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Thanks for your quick reply.

I need to investigate this a bit more because my website is basically hand coded (using Microsoft Expressions to help) and as far as I am aware it does not use any plugins or widgets.

lammert

5:04 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



SharedArrayBuffers can be used for more than WebGL rendering. They function as communication memory between multiple JavaScript tasks. But if your site is hand coded, it seems weird to me that you used these buffers, it requires high level JS programming knowledge to use and synchronize multiple JS tasks in parallel.

For a layman's overview of what they are, you can look at A cartoon intro to ArrayBuffers and SharedArrayBuffers [hacks.mozilla.org]

SharedArrayBuffers have a bad reputation, because they were used in the Spectre attacks in 2018 and have been disabled by browsers by default, although some browser versions are allowing them again.

nomis5

5:14 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Thanks for the response. Yes the site is hand coded, with a little help from Microsoft Expressions.

I do have some JavaScript on the site but very simple and basic. I have very little technical website programming knowledge and I am the only one who has written the website.

It may be a mistake by Google, that has happened before, I will wait and see for the moment. I will however take a look at the cartoon explanation you suggest, but I think that my technical expertise is so limited that even cartoons on this subject may prove challenging!

NickMNS

5:26 pm on Mar 15, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



WebGL is used for graphics, like drawing charts and graphs or 3D graphics, possibly even 3D fonts. It is possible that Microsoft Expressions is rendering some graphical components using WebGL

robzilla

10:02 am on Mar 16, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Unconfirmed, but this may (ironically) be caused by Google Analytics: [twitter.com...]

May not trigger for everyone, though, as noted in that thread.

So have a look at third-party scripts you're loading.

Pjman

2:09 am on Mar 19, 2021 (gmt 0)

10+ Year Member Top Contributors Of The Month



Any Update on this one guys?

@RustyBrick this is where you usually drop knowledge on us and we all bow to you.

robzilla

8:38 am on Mar 19, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Still a bit of a mystery. Google's kept mum so far.

If not Analytics, then AdSense perhaps? Or simply a false positive.

(Haven't received the message myself.)

iamlost

9:30 am on Mar 20, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Disclaimer: I have not received the aforementioned message and am responding (as apparently no one else in this thread understands the context) based solely on conversations within the web ad industry and my own subject knowledge.

The critical point for most/all webdevs is to ignore the message. Do not, I say again, do not add COOP/COEP headers to your site.

Unless you know your site itself uses SharedArrayBuffers (SABs) aka third-party storage adding the headers will probably break many/all ads and possibly the site itself as scripts stop working.
There now, did I freak you out enough?

The reality:
At least one major third party ad vendor currently uses SABs as part of a built in measurement/analytics methodology. And they (and any others similar) are who actually need to ‘fix’ their scripts by May 25 (projected Chrome 91 release date).

Note: the most common ad usage of SABs is as a third party cookie replacement.

Google being dumb software sees the SABs as being used by your site rather than by a third party. Can you say lack of sorcerer’s apprentice oversight?

Note: it is also possible that other (non-ad) JavaScript on your site may be running SABs - something to check with the developers in question. A quick and dirty rule of thumb (not to be trusted as certain) is that if everything works as designed in FireFox then SABs are unlikely present given that FF has long restricted SAB - this is Chrome also tightening up.