Re: [whatwg/fetch] Delay opaque responses until response body is in (#355)

http://papers.mathyvanhoef.com/blackhat2016.pdf argues that the defense I describe is infeasible (section 4.1.1), but I'm not sure that is correct.

The way the attack works is the combination of `fetch()` resolving early (`responseStart` is gotten through `performance.now()`), and resource timing revealing `responseEnd`.

@jakearchibald yes, but requiring two distinct fetches makes this significantly harder I think and the server might react differently too as the request looks different.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/355#issuecomment-237782280