[whatwg/fetch] Don't expose body size for cross-origin or tainted subframe navigations (PR #1961)

These values are "CORS-protected" for subresources, however iframes (and <object> etc) are never CORS-protected, so we only expose these values for same-origin iframes without cross-origin redirects.

(This is already the ground truth in blink, and AFAIK webkit doesn't
 expose cross-origin body size info)

Closes #1960

<!--
Thank you for contributing to the Fetch Standard! Please describe the change you are making and complete the checklist below if your change is not editorial.

When you submit this PR, and each time you edit this comment (including checking a checkbox through the UI!), PR Preview will run and update it. As such make any edits in one go and only after PR Preview has run.

If you think your PR is ready to land, please double-check that the build is passing and the checklist is complete before pinging.
-->

- [ ] At least two implementers are interested (and none opposed):
   * Chromium (already implemented)
   * …
- [ ] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at:
   * … <!-- If these tests are tentative, link a PR to make them non-tentative. -->
- [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed:
   * Chromium: …
   * Gecko: …
   * WebKit: …
- [x] [MDN issue](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) is filed: https://github.com/mdn/content/issues/23740 tracks this
- [x] The top of this comment includes a [clear commit message](https://github.com/whatwg/meta/blob/main/COMMITTING.md) to use. <!-- If you created this PR from a single commit, Github copied its message. Otherwise, you need to add a commit message yourself. -->

(See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)


<!--
    This comment and the below content is programmatically generated.
    You may add a comma-separated list of anchors you'd like a
    direct link to below (e.g. #idl-serializers, #idl-sequence):

    Don't remove this comment or modify anything below this line.
    If you don't want a preview generated for this pull request,
    just replace the whole of this comment's content by "no preview"
    and remove what's below.
-->
***
<a href="https://whatpr.org/fetch/1961.html" title="Last updated on Sep 29, 2026, 1:40 PM UTC (259528e)">Preview</a> | <a href="https://whatpr.org/fetch/1961/357bd98...259528e.html" title="Last updated on Sep 29, 2026, 1:40 PM UTC (259528e)">Diff</a>
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/1961

-- Commit Summary --

  * Don't expose body size for cross-origin or tainted subframe navigations

-- File Changes --

    M fetch.bs (28)

-- Patch Links --

https://github.com/whatwg/fetch/pull/1961.patch
https://github.com/whatwg/fetch/pull/1961.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1961
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1961@github.com>