Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Hide TAO-protected timing info from navigation timing when cross-origin redirects are present #7104

Closed
Tracked by #38
noamr opened this issue Sep 23, 2021 · 0 comments · Fixed by w3c/navigation-timing#170
Closed
Tracked by #38

Hide TAO-protected timing info from navigation timing when cross-origin redirects are present #7104

noamr opened this issue Sep 23, 2021 · 0 comments · Fixed by w3c/navigation-timing#170

Comments

@noamr
Copy link
Collaborator

noamr commented Sep 23, 2021

See w3c/navigation-timing#158

Currently the spec only hides the internal timing information for non-navigation resources.
It should also hide them for navigation timing, regardless of TAO.

This clarifies behavior of existing test, web-platform-tests/wpt#25679
noamr added a commit to noamr/fetch that referenced this issue Sep 23, 2021
@noamr
Expose a mechanism for hiding internal timing info
cb872fb 
This is needed for whatwg/html#7104
and later on for whatwg#1215.

Navigation timing reports the timing info from the HTML spec,
so it needs a mechanism to obfuscate the internals. So far that
obfuscation was internal to fetch and was done upon reporting.
@noamr noamr mentioned this issue Sep 23, 2021
Merged
noamr added a commit to noamr/html that referenced this issue Sep 23, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
65b5fb1 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@noamr noamr mentioned this issue Sep 23, 2021
Closed
noamr added a commit to noamr/html that referenced this issue Sep 23, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
27caec8 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@whatwg whatwg deleted a comment Sep 25, 2021
@noamr noamr mentioned this issue Sep 26, 2021
Closed
20 tasks
noamr added a commit to noamr/html that referenced this issue Sep 29, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
5632bca 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
annevk pushed a commit to whatwg/fetch that referenced this issue Sep 30, 2021
@noamr
Expose a mechanism for hiding internal timing info
8659a25 
This is needed for whatwg/html#7104 and #1215.
noamr added a commit to noamr/html that referenced this issue Jan 17, 2022
@noamr
Hide some navigation timing info when cross-origin redirects are present
dae2121 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
noamr added a commit to noamr/html that referenced this issue Feb 8, 2022
@noamr
Hide some navigation timing info when cross-origin redirects are present
ee4a4af 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@noamr noamr mentioned this issue Feb 24, 2022
Merged
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
2 participants
@noamr and others