Test that we don't indirectly expose redirect timing

[noamr]

Exposing connection timing info such as domainLookupStart may expose the
fact that a cross-origin redirect has occured, information which should
be hidden.

This is fixed in whatwg/html#7105, and this
modifies the test to account for the new behavior.

[yoavweiss]

LGTM

[noamr]

Will merge once whatwg/html#7105 is approved.

[sefeng211]

I checked the obsolete interface for PerformanceNavigationTiming. It looks like only some of the timings require the cross-origin check such as redirectStart and redirectEnd. For things like domainLookupStart, we don't seem to do the cross-origin check.

What am I missing? Please feel free to educate me, Thanks!

[noamr]

I checked the obsolete interface for PerformanceNavigationTiming. It looks like only some of the timings require the cross-origin check such as redirectStart and redirectEnd. For things like domainLookupStart, we don't seem to do the cross-origin check.

What am I missing? Please feel free to educate me, Thanks!

This is a proposed behavior change in the spec, to clarify that navigation timing should behave like resource timing in terms of the TAO-hidden properties. I filed the test and browser bugs together with the proposed spec change. see here.