Re: [whatwg/storage] Exposing cross-origin resource size (#31)

When the opaque response is compressed, and the `Content-Length` header is present, it's possible to launch a compression-based attack (described in more detail [here](https://tom.vg/2016/08/request-and-conquer/#compression-based-attacks)) with this size-exposing attack. Similar to https://github.com/w3c/resource-timing/issues/64, this allows an attacker to leak content from cross-origin resources.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/storage/issues/31#issuecomment-241321897