image" was not compatible with deployed content.
+Cross-origin read blocking, better known as CORB, is an algorithm which identifies
+dubious cross-origin resource fetches (e.g., fetches that would fail anyway like attempts to render
+JSON inside an img element) and blocks them before they reach a web page. CORB reduces
+the risk of leaking sensitive data by keeping it further from cross-origin web pages.
+
+
A CORB-protected MIME type is an HTML MIME type, a JSON MIME type, or an
+XML MIME type excluding image/svg+xml.
+
+
Even without CORB, accessing the content of cross-origin resources with
+CORB-protected MIME types is either managed by the CORS protocol (e.g., in case of
+{{XMLHttpRequest}}), not observable (e.g., in case of pings or CSP reports which ignore the
+response), or would result in an error (e.g., when failing to decode an HTML document embedded in an
+img element as an image). This means that CORB can block
+CORB-protected MIME types resources without being disruptive to web pages.
+
+
To perform a CORB check, given a request and response, +run these steps:
+ +If request's initiator is "download", then return
+ allowed.
+
+
If we recast downloading as navigation this step can be removed. + +
If request's current url's scheme is not an + HTTP(S) scheme, then return allowed. + +
Let mimeType be the result of extracting a MIME type + from response's header list. + +
If response's status is 206 and
+ mimeType (ignoring parameters) is a CORB-protected MIME type, then return
+ blocked.
+
+
Let nosniff be the result of extracting header values from the
+ first header whose name is a byte-case-insensitive
+ match for `X-Content-Type-Options` in response's
+ header list.
+
+
If nosniff is not failure and mimeType (ignoring parameters) is a
+ CORB-protected MIME type or text/plain, then return blocked.
+
+
CORB only protects text/plain responses with a
+ `X-Content-Type-Options: nosniff` header. Unfortunately, protecting such responses
+ without that header when their status is 206 would break too many
+ existing video responses that have a text/plain MIME type.
+
+
+
+
+
Return allowed. +
opaque".
- Return the result of performing a scheme fetch - using request. +
Let noCorsResponse be the result of performing a scheme fetch using + request. + +
If noCorsResponse is a filtered response or the CORB check with + request and noCorsResponse returns allowed, then return + noCorsResponse. + +
Set corbSanitizedResponse to a new response whose + status is noCorsResponse's status, + HTTPS state is noCorsResponse's + HTTPS state, and CSP list is + noCorsResponse's CSP list. + +
This is only an effective defense against side channel attacks if + noCorsResponse is kept isolated from the process that initiated the request. + +
Return corbSanitizedResponse.