Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hide TAO-protected timing info from navigation timing when cross-origin redirects are present #7104

Closed
Tracked by #38
noamr opened this issue Sep 23, 2021 · 0 comments · Fixed by w3c/navigation-timing#170
Closed
Tracked by #38

Hide TAO-protected timing info from navigation timing when cross-origin redirects are present #7104

noamr opened this issue Sep 23, 2021 · 0 comments · Fixed by w3c/navigation-timing#170

Comments

@noamr
Copy link
Contributor

noamr commented Sep 23, 2021

See w3c/navigation-timing#158

Currently the spec only hides the internal timing information for non-navigation resources.
It should also hide them for navigation timing, regardless of TAO.

This clarifies behavior of existing test, web-platform-tests/wpt#25679
noamr added a commit to noamr/fetch that referenced this issue Sep 23, 2021
@noamr
Expose a mechanism for hiding internal timing info
cb872fb 
This is needed for whatwg/html#7104
and later on for whatwg#1215.

Navigation timing reports the timing info from the HTML spec,
so it needs a mechanism to obfuscate the internals. So far that
obfuscation was internal to fetch and was done upon reporting.
@noamr noamr mentioned this issue Sep 23, 2021
Merged
noamr added a commit to noamr/html that referenced this issue Sep 23, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
65b5fb1 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@noamr noamr mentioned this issue Sep 23, 2021
Closed
noamr added a commit to noamr/html that referenced this issue Sep 23, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
27caec8 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@whatwg whatwg deleted a comment Sep 25, 2021
@noamr noamr mentioned this issue Sep 26, 2021
Closed
20 tasks
noamr added a commit to noamr/html that referenced this issue Sep 29, 2021
@noamr
Hide some navigation timing info when cross-origin redirects are present
5632bca 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
annevk pushed a commit to whatwg/fetch that referenced this issue Sep 30, 2021
@noamr
Expose a mechanism for hiding internal timing info
8659a25 
This is needed for whatwg/html#7104 and #1215.
noamr added a commit to noamr/html that referenced this issue Jan 17, 2022
@noamr
Hide some navigation timing info when cross-origin redirects are present
dae2121 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
noamr added a commit to noamr/html that referenced this issue Feb 8, 2022
@noamr
Hide some navigation timing info when cross-origin redirects are present
ee4a4af 
When a navigation includes cross-origin redirects, the navigation timing
entry should not include information about redirect timing and internal
network timing, as that may expose cross-origin timing information.

This is already implemented and tested, but has been omitted when
refactoring the navigation timing spec into HTML.

Closes whatwg#7104
@noamr noamr mentioned this issue Feb 24, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
2 participants
@noamr and others