[whatwg/fetch] Response body info (decoded/encoded size) should be zeroed for cross-origin subframe navigation (Issue #1960)

noamr created an issue (whatwg/fetch#1960)

### What is the issue with the Fetch Standard?

Response body size is currently CORS protected. This works well for subresources, but it means that iframes always "pass" and supposedly expose those values to resource timing.

In Blink, response body size is hidden for cross-origin iframes or for iframes with opaque redirect tainting (cross-origin redirects).

I believe that in WebKit encoded/decoded body size is same-origin anyway.
Suggesting to align with the implemented reality, which is more secure than the current spec.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1960
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1960@github.com>