Re: [whatwg/fetch] Add TAO check (#955)

npm1 commented on this pull request.



> +<var>response</var>, run these steps:
+
+<ol>
+ <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is set, then return
+ failure.
+
+ <li><p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>basic</code>", then return success.
+
+ <li><p>Let <var>values</var> be the result of
+ <a for="header list">getting, decoding, and splitting</a>
+ `<code>Timing-Allow-Origin</code></a>` from <var>response</var>'s <a for=response>header list</a>.
+
+ <li><p>If <var>values</var> contains `<code>*</code>`, then return success.
+
+ <li><p>Let <var>serializedOrigin</var> be the result of <a>serializing a request origin</a> with
+ <var>request</var>.

https://github.com/web-platform-tests/wpt/blob/master/resource-timing/crossorigin-sandwich-TAO.sub.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1022816
https://bugzilla.mozilla.org/show_bug.cgi?id=1597808
https://bugs.webkit.org/show_bug.cgi?id=204375

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/955#discussion_r348196456