Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change approach to fallback PNG in the header to fix blank data URI from triggering CSP error #2229

Merged
merged 3 commits into from
May 19, 2021

Commits on May 17, 2021

  1. Configuration menu
    Copy the full SHA
    f084ce6 View commit details
    Browse the repository at this point in the history
  2. Use conditional comments for header fallback PNG

    The current fallback uses an `<image>` element, which is interpreted differently depending on whether it’s parsed in the context of SVG or HTML.
    
    We include an `xlink:href` attribute on the `<image>` tag to prevent versions of IE which support SVG from downloading the fallback image when they don't need to.
    
    However, this approach has proved problematic – IE11 still requests the fallback PNG when printing, which can cause issues with sessions (#2045) and an attempted fix for that issue by using a blank data uri has now caused further issues with Content Security Policies (#2203).
    
    Switch to the simpler approach of using conditional comments for the header fallback PNG, targeting Internet Explorer 8 specifically. We can then use a good old-fashioned `<img>` tag.
    
    This does mean that browsers that do not support SVG other than Internet Explorer 8 will not be able to see the crown emblem.
    
    According to Can I Use, the other main browser that does not support SVG that we may need to consider is Android 2.1 - 2.3 [1].
    
    Between 2020-05-14 and 2021-04-30 analytics for GOV.UK shows 6,792 (0.00041%) sessions from 4,343 (0.00119%) users using Android 2.x, out of 577,929,096 sessions from 77,144,107 users.
    
    By comparison, in the same period we saw 36,075 sessions (0.00217%) from 28,963 users (0.00791%) using IE8.
    
    It appears that Android 2.x browsers just omit the SVG entirely – there’s no ‘broken image’ displayed – these users just see ‘GOV.UK’ without the crown.
    
    Given the very low volume of traffic from these browsers, this seems like an acceptable thing to do.
    
    We could have removed the fallback PNG entirely, however our browser support explicitly states support for Internet Explorer 8 (‘although components may not look perfect’) and we know that some service teams do have a disproprtionate number of IE8 users – which is unlikely to be the case for Android 2.
    
    [1]:https://caniuse.com/svg
    36degrees committed May 17, 2021
    Configuration menu
    Copy the full SHA
    cf4790b View commit details
    Browse the repository at this point in the history

Commits on May 19, 2021

  1. Document in CHANGELOG

    36degrees committed May 19, 2021
    Configuration menu
    Copy the full SHA
    8ff8819 View commit details
    Browse the repository at this point in the history