Body sizes should be CORS rather than TAO protected #1556

noamr · 2022-12-04T07:40:32Z

encoded/decoded body size relate to the resource, not to the timing. Body size of cors-same-origin resources is anyway observable in service workers.

This is part of
w3c/resource-timing#220 (comment)

At least two implementers are interested (and none opposed):
- Chromium
- Gecko
Tests are written and can be reviewed and commented upon at:
- Reland "Make body size CORS-protected instead of TAO-protected" web-platform-tests/wpt#37884
- Update encoded/decoded body length for service-worker responses web-platform-tests/wpt#37257
Implementation bugs are filed:
- Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=1404669
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1811293
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=251144
MDN issue is filed: Be more accurate about cross-origin protections mdn/content#23740

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

Instead of relying on the network, count the bytes as they come in and use the sum as the metric, only for service-worker responses. Corresponds to the relevant spec change: https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith (search for "encoded size") and to proposed spec change: whatwg/fetch#1556 Bug: 925239 Change-Id: I7d47c4febef61a89128cc50003f9f2058f3c1270

annevk · 2022-12-07T13:25:48Z

I think we should use the network error and filtered response concepts here instead.

In that we define that a network error's body info is always a new one and the same for both opaque filtered responses.

noamr · 2022-12-07T13:30:16Z

I think we should use the network error and filtered response concepts here instead.

In that we define that a network error's body info is always a new one and the same for both opaque filtered responses.
Done

annevk · 2022-12-07T13:37:09Z

I meant that we should update the definitions of network error and the two types of opaque responses to override the body info field. That way we don't have to do anything here or other places that might get hold of a response.

noamr · 2022-12-07T13:45:40Z

I meant that we should update the definitions of network error and the two types of opaque responses to override the body info field. That way we don't have to do anything here or other places that might get hold of a response.

Gotcha I think. Will revise.

annevk

Yeah this looks good. Tiny nit and then this can merge once the checkboxes are done.

annevk · 2022-12-08T12:22:42Z

fetch.bs

@@ -2366,6 +2366,7 @@ known as an <dfn export id=concept-aborted-network-error>aborted network error</
 <p>A <a>network error</a> is a <a for=/>response</a> whose
 <a for=response>status</a> is always 0,
 <a for=response>status message</a> is always the empty byte sequence,
+<a for=response>body info</a> is always a new <a for=/>response body info</a>,
 <a for=response>header list</a> is always empty, and
 <a for=response>body</a> is always null.


Nit: can we put body info at the end throughout as it's defined last of these fields?

Instead of relying on the network, count the bytes as they come in and use the sum as the metric, only for service-worker responses. Corresponds to the relevant spec change: https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith (search for "encoded size") and to proposed spec change: whatwg/fetch#1556 Bug: 925239 Change-Id: I7d47c4febef61a89128cc50003f9f2058f3c1270

Instead of relying on the network, count the bytes as they come in and use the sum as the metric, only for service-worker responses. Corresponds to the relevant spec change: https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith (search for "encoded size") and to proposed spec change: whatwg/fetch#1556 Bug: 925239 Change-Id: I7d47c4febef61a89128cc50003f9f2058f3c1270 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4065971 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1081848}

…ervice-worker responses, a=testonly Automatic update from web-platform-tests Update encoded/decoded body length for service-worker responses Instead of relying on the network, count the bytes as they come in and use the sum as the metric, only for service-worker responses. Corresponds to the relevant spec change: https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith (search for "encoded size") and to proposed spec change: whatwg/fetch#1556 Bug: 925239 Change-Id: I7d47c4febef61a89128cc50003f9f2058f3c1270 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4065971 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1081848} -- wpt-commits: 998e292d3e0296e922d002930986a6156733734f wpt-pr: 37257

annevk · 2023-01-03T09:20:43Z

This needs rebasing on top of #1561 now.

encoded/decoded body size relate to the resource, not to the timing. Body size of cors-same-origin resources is anyway observable in service workers. This is part of w3c/resource-timing#220 (comment)

noamr · 2023-01-03T09:29:04Z

This needs rebasing on top of #1561 now.

Done

fetch.bs

…ervice-worker responses, a=testonly Automatic update from web-platform-tests Update encoded/decoded body length for service-worker responses Instead of relying on the network, count the bytes as they come in and use the sum as the metric, only for service-worker responses. Corresponds to the relevant spec change: https://w3c.github.io/ServiceWorker/#dom-fetchevent-respondwith (search for "encoded size") and to proposed spec change: whatwg/fetch#1556 Bug: 925239 Change-Id: I7d47c4febef61a89128cc50003f9f2058f3c1270 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4065971 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1081848} -- wpt-commits: 998e292d3e0296e922d002930986a6156733734f wpt-pr: 37257

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

annevk

It looks like there's still a number of checkboxes to complete in OP. Otherwise this looks great though, thanks!

noamr · 2023-01-03T10:20:28Z

@emilio, @bdekoz, how do you feel about this for Gecko?
(Webkit doesn't have encoded/decode body sizes for cross-origin resources)

Tests whatwg/fetch#1556

The transferSize delta remains TAO-protected as it measures the fetch rather than the resource. See spec change: whatwg/fetch#1556 Bug: 1404669 Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 Fixes: 1404669

The transferSize delta remains TAO-protected as it measures the fetch rather than the resource. Currently behind a runtime flag, until we discuss this with the RUM community. See spec change: whatwg/fetch#1556 Bug: 1404669 Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 Fixes: 1404669

The transferSize delta remains TAO-protected as it measures the fetch rather than the resource. Currently behind a runtime flag, until we discuss this with the RUM community. See spec change: whatwg/fetch#1556 Bug: 1404669 Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 Fixes: 1404669 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091399}

The transferSize delta remains TAO-protected as it measures the fetch rather than the resource. Currently behind a runtime flag, until we discuss this with the RUM community. See spec change: whatwg/fetch#1556 Bug: 1404669 Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 Fixes: 1404669 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091399}

This reverts commit 3a8f3fd. Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview Original change's description: > Make body size CORS-protected instead of TAO-protected > > The transferSize delta remains TAO-protected as it measures > the fetch rather than the resource. > > Currently behind a runtime flag, until we discuss this with the > RUM community. > > See spec change: whatwg/fetch#1556 > > Bug: 1404669 > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > Fixes: 1404669 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091399} Bug: 1404669 Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 Reviewed-by: Tom Lukaszewicz <tluk@google.com> Owners-Override: Tom Lukaszewicz <tluk@google.com> Commit-Queue: Victor Tan <victortan@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091414}

This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed, now it's open again Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b

This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b

This reverts commit a5609f5. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4158031 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091712}

This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4158031 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091712}

This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4158031 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091712} Co-authored-by: Noam Rosenthal <nrosenthal@chromium.org>

bdekoz · 2023-01-19T17:05:06Z

This is ok for gecko

bdekoz · 2023-01-19T17:08:53Z

here is the Moz tracker BZ: https://bugzilla.mozilla.org/show_bug.cgi?id=1811293

…stead of TAO-protected", a=testonly Automatic update from web-platform-tests Reland "Make body size CORS-protected instead of TAO-protected" (#37884) This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4158031 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091712} Co-authored-by: Noam Rosenthal <nrosenthal@chromium.org> -- wpt-commits: 8547b57c0e2de466d5e8524a65ff02b531a5775a wpt-pr: 37884

noamr · 2023-01-25T12:49:08Z

It looks like there's still a number of checkboxes to complete in OP. Otherwise this looks great though, thanks!

Done.

annevk · 2023-01-25T12:56:08Z

@noamr can you look into the first set of tests linked? It seems that changeset got reverted.

noamr · 2023-01-25T12:57:33Z

@noamr can you look into the first set of tests linked? It seems that changeset got reverted.

Yea it relanded, so relinked.

…stead of TAO-protected", a=testonly Automatic update from web-platform-tests Reland "Make body size CORS-protected instead of TAO-protected" (#37884) This reverts commit a5609f5e8a2afa6bb60619bbc34a6fbe7167f981. Reason for revert: tree was closed Original change's description: > Revert "Make body size CORS-protected instead of TAO-protected" > > This reverts commit 3a8f3fd8736b1721535af5aa148996a2767079e3. > > Reason for revert: cause tree close: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cfm-rel/36567/overview > > Original change's description: > > Make body size CORS-protected instead of TAO-protected > > > > The transferSize delta remains TAO-protected as it measures > > the fetch rather than the resource. > > > > Currently behind a runtime flag, until we discuss this with the > > RUM community. > > > > See spec change: whatwg/fetch#1556 > > > > Bug: 1404669 > > Change-Id: I8d6d0e3f8e2dc31597b06f6d7b1e426381463226 > > Fixes: 1404669 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4135873 > > Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> > > Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#1091399} > > Bug: 1404669 > Change-Id: Ieb987fca2038b9c6daa57875a02e7d82ab673cf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4156734 > Reviewed-by: Tom Lukaszewicz <tluk@google.com> > Owners-Override: Tom Lukaszewicz <tluk@google.com> > Commit-Queue: Victor Tan <victortan@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1091414} Bug: 1404669 Change-Id: I55d4fbc9b69fcc4d676a8cc9f2c8f97a50c8ff8b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4158031 Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091712} Co-authored-by: Noam Rosenthal <nrosenthal@chromium.org> -- wpt-commits: 8547b57c0e2de466d5e8524a65ff02b531a5775a wpt-pr: 37884

chromium-wpt-export-bot mentioned this pull request Dec 4, 2022

Update encoded/decoded body length for service-worker responses web-platform-tests/wpt#37257

Merged

noamr mentioned this pull request Dec 8, 2022

CORS, CORP, TAO & "public static resource" metadata whatwg/html#8143

Open

annevk reviewed Dec 8, 2022

View reviewed changes

annevk mentioned this pull request Dec 8, 2022

Editorial: clean up definitions of network errors #1561

Merged

noamr added 3 commits January 3, 2023 11:23

Body sizes should be CORS rather than TAO protected

3930f6a

encoded/decoded body size relate to the resource, not to the timing. Body size of cors-same-origin resources is anyway observable in service workers. This is part of w3c/resource-timing#220 (comment)

Use opaque filtered response

0c68411

Update definitions for body info

6ed6bff

noamr force-pushed the body-size-cors branch from 85351a1 to 6ed6bff Compare January 3, 2023 09:27

annevk reviewed Jan 3, 2023

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

noamr and others added 2 commits January 3, 2023 11:55

Update fetch.bs

0f33175

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

Update fetch.bs

9071708

Co-authored-by: Anne van Kesteren <annevk@annevk.nl>

annevk approved these changes Jan 3, 2023

View reviewed changes

noamr added a commit to web-platform-tests/wpt that referenced this pull request Jan 3, 2023

Test that body-size is CORS-protected and not TAO-protected

5c9910a

Tests whatwg/fetch#1556

noamr mentioned this pull request Jan 3, 2023

Test that body-size is CORS-protected and not TAO-protected web-platform-tests/wpt#37737

Closed

chromium-wpt-export-bot mentioned this pull request Jan 4, 2023

Make body size CORS-protected instead of TAO-protected web-platform-tests/wpt#37755

Closed

chromium-wpt-export-bot mentioned this pull request Jan 11, 2023

Reland "Make body size CORS-protected instead of TAO-protected" web-platform-tests/wpt#37884

Merged

annevk merged commit e1e9567 into whatwg:main Jan 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Body sizes should be CORS rather than TAO protected #1556

Body sizes should be CORS rather than TAO protected #1556

noamr commented Dec 4, 2022 •

edited by pr-preview bot

Loading

annevk commented Dec 7, 2022

noamr commented Dec 7, 2022

annevk commented Dec 7, 2022

noamr commented Dec 7, 2022

annevk left a comment

annevk Dec 8, 2022

annevk commented Jan 3, 2023

noamr commented Jan 3, 2023

annevk left a comment

noamr commented Jan 3, 2023

bdekoz commented Jan 19, 2023

bdekoz commented Jan 19, 2023

noamr commented Jan 25, 2023

annevk commented Jan 25, 2023

noamr commented Jan 25, 2023

Body sizes should be CORS rather than TAO protected #1556

Body sizes should be CORS rather than TAO protected #1556

Conversation

noamr commented Dec 4, 2022 • edited by pr-preview bot Loading

annevk commented Dec 7, 2022

noamr commented Dec 7, 2022

annevk commented Dec 7, 2022

noamr commented Dec 7, 2022

annevk left a comment

Choose a reason for hiding this comment

annevk Dec 8, 2022

Choose a reason for hiding this comment

annevk commented Jan 3, 2023

noamr commented Jan 3, 2023

annevk left a comment

Choose a reason for hiding this comment

noamr commented Jan 3, 2023

bdekoz commented Jan 19, 2023

bdekoz commented Jan 19, 2023

noamr commented Jan 25, 2023

annevk commented Jan 25, 2023

noamr commented Jan 25, 2023

noamr commented Dec 4, 2022 •

edited by pr-preview bot

Loading