Re: [whatwg/fetch] Proposal: CORS means TAO by default (Issue #1414)

OK, I see a point here.
- `transferSize`, `encodedBodySize` and `decodedBodySize` are all observable as part of the resource anyway
- `redirectStart`, `redirectEnd`, `requestStart`, and `responseStart` are also observable today - you can create a fetch to the resource with {redirect: `manual`} or with sending/receiving a stream rather than a full resource and measure them yourself.

So really all these attributes (anything outside the `connection info`) are observable as long as you can fetch the resource (CORS-same-origin), and TAO-hiding them doesn't add a layer of protection, only some inconvenience. 

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1414#issuecomment-1072127788
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1414/1072127788@github.com>