Make TAO a subset of CORS
Nobody has claimed this yet.
- Dominant language
- Bikeshed
- Stars
- 135
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
The current timing allow check algorithm does not take CORS into account. Effectively that means that even when a response is not opaque and its contents can be inspected by script, its detailed timing information will not be available.
I believe that if a request's response is available for inspection, its timing information cannot reveal any new information, so there's no reason for us to gate it on the presence of TAO headers. Therefore, I propose to further integrate the timing allow check with the CORS check, so that if the latter passes, the former passes as well.
/cc @annevk
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Resource Timing timing allow check and Fetch CORS check algorithms. Determine how a successful CORS check should integrate with the timing allow check, then update the specification so the behavior is defined consistently and verify the resulting algorithm text against the proposal.
Written by the indexing model from the issue text.
Assessment
- Domain
- performance, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100