Re: [whatwg/fetch] Consider if redirect tainting should apply to `Timing-Allow-Origin` (Issue #1484)

> This does not just apply in A1 -> B -> A2 scenarios (though there too A2 might not want A1 to think it wasn't influenced by B), but also in A -> B -> C scenarios. C shouldn't think the authority is A when it's really a mix of A and B.

This issue also applies to A -> B -> C.
In TAO, unlike CORS, B doesn't have any influence over C. The only thing exposed is timing of a resource from C, and it's only exposed to A. How can B affect the timing in a way that would make C expose something that it doesn't want to A?

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1484#issuecomment-1257164760
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1484/1257164760@github.com>