Re: [whatwg/fetch] Delay opaque responses until response body is in (#355)

> So you need a service worker for this attack?

No, `fetch()` coupled with the resource timing API is sufficient.

> Seems like we should be removing body load detection time rather than header time.

No, since then you could still do it pretty accurately with two requests I think. One from `<object>` or some such and one from `fetch()`. And the requests would look identical (unlike the "cors" scenario).

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/355#issuecomment-237792959