Re: [whatwg/fetch] Streaming upload and HTTP protocol info leak (#1007)

Belatedly catching up...

Seems to me that it would be near impossible for us to prevent the observable differences between HTTP/1.0, HTTP/1.1 and HTTP/2. They request sending and TCP/TLS connection patterns are different enough to make them highly observable without requiring a direct API.
The presence of caching proxies is also detectable using onload (e.g. by fetching resources that should be cached and observing RTTs, vs. fetching resources from the origin).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1007#issuecomment-653455350

Received on Friday, 3 July 2020 09:42:55 UTC