Request Security Review of Resource Timing Level 2

Hi all,

The WebPerf WG is preparing to move the Resource Timing Level 2 spec to 
CR,
    https://www.w3.org/TR/performance-timeline-2/

This spec defines a PerformanceResourceTiming interface, which 
participates in the Performance Timeline and facilitates timing 
measurement of downloadable resources. The information exposed by this 
interface is defined by a set of attributes[1] in the 
PerformanceResourceTiming interface.

For Cross-origin Resources, the spec defines a Timing-Allow-Origin 
Response Header[2] and a timing allow check algorithm to determine 
whether their information can be fully exposed. Please also look at the 
Privacy and Security section[3] for more detail.

Please let us know if there is any security concern for Performance 
Timeline before the end of January, either by email 
<public-web-perf@w3.org> or use GitHub issues 
<https://github.com/w3c/resource-timing>.

Thanks.

-xiaoqian

[1] 
https://www.w3.org/TR/resource-timing-2/#sec-performanceresourcetiming
[2] https://www.w3.org/TR/resource-timing-2/#dfn-timing-allow-check
[3] https://www.w3.org/TR/resource-timing-2/#sec-privacy-security

Received on Wednesday, 4 December 2019 15:58:19 UTC