Cross-origin redirect and Navigation Timing / Resource Timing

WPT results below are from the latest aligned runs as of 2026-09-14:
experimental = Chrome 155 / Firefox 158 / STP 252 (c1fc85d610),
stable = Chrome 153 / Firefox 155 / Safari 26.6 (9db4b48c1f).

Navigation Timing

• navigation-timing/redirect-tao.html — Chrome 6/6 · Firefox 3/6 · Safari 3/6 stable → 6/6
  STP
  TAO-gated exposure of redirect timing on cross-origin navigation redirects (whatwg/fetch#1931, whatwg/html#12513). The
  same three subtests fail in Gecko and stable WebKit, all with assert_equals: redirectCount expected 1 but got 0:

  • Exposed when a cross-origin redirect opts in to the destination origin
  • Exposed when a cross-origin redirect opts in with a wildcard
  • Exposed when every redirect in the chain opts in to the destination origin

  The three negative subtests (Hidden when…) pass in every engine, so both engines implement blanket hiding and ignore the opt-in. WebKit appears to have fixed this between 26.6 and STP 252, leaving Gecko
  as the sole holdout.

Resource Timing

• resource-timing/SO-XO-SO-redirect-chain-tao.https.html — Chrome 4/4 ·
  Firefox 4/4 · Safari 3/4
  assert_equals: redirectStart should be 0 expected 0 but got 160 — WebKit leaks redirect timing on a same-origin → cross-origin → same-origin chain that should not expose it.

• resource-timing/same-origin-from-cross-origin-redirect.html — Chrome
  1/1 · Firefox 0/1 · Safari 1/1
  assert_equals: fetchStart must equal startTime expected 51 but got 72.

• resource-timing/object-not-found-after-cross-origin-redirect.html
  — Chrome 1/1 · Firefox 1/1 · Safari 0/1
  TimeoutError: Timeout was reached before load or error events fired.

• 
  resource-timing/object-not-found-after-TAO-cross-origin-redirect.html
  — Chrome 7/7 · Firefox 7/7 · Safari 2/3 + harness TIMEOUT
  WebKit only reaches 3 of the 7 subtests before the harness times out.

• resource-timing/sizes-redirect-img.html — Chrome 5/5 · Firefox 5/5 · Safari 2/5
  decodedBodySize expected 1010 but got 0 on cross origin redirect and cross origin to same origin redirect; same origin to remote origin to same origin redirect times out.

• resource-timing/sizes-redirect.any.html — Chrome 1/1 · Firefox 1/1 · Safari 0/1
  TypeError: Load failed.

• resource-timing/sizes-redirect.any.worker.html — Chrome 1/1 · Firefox 0/1 ·
  Safari 0/1
  Firefox: decodedBodySize expected 4 but got 0. Safari: TypeError: Load failed.

• resource-timing/cross-origin-redirects.html — Chrome 11/11 · Firefox 11/11 · Safari
  10/11 (experimental only; 11/11 on 26.6)
  assert_greater_than: redirectStart should be greater than 0 expected a number greater than 0 but got 0 — looks like an STP regression.

Adjacent failures (cross-origin redirect is only the setup)

These fail for reasons unrelated to redirect timing, but show up in the same test files:

• resource-timing/response-status-code.cross-origin-redirect.html —
  Chrome 30/30 · Firefox 30/30 · Safari 0/30 (responseStatus is undefined; the same-origin sibling test is also 0/30, so this is "WebKit doesn't implement responseStatus")
• resource-timing/content-type.html — Chrome 21/21 · Firefox 21/21 · Safari 0/21 + TIMEOUT
• resource-timing/delivery-type.tentative.any.html and
  .worker — Chrome 3/3 · Firefox 0/3 (deliveryType undefined) · Safari 1/3 (no
  "cache" deliveryType)

Test coverage gaps

Not failures — tests that don't exist yet:

1. No NavTiming equivalent of SO-XO-SO-redirect-chain-tao.https.html. Nothing tests a navigation redirect chain that goes cross-origin and returns to the initial origin.
2. Nothing tests the navigationStart-as-timeOrigin inference described in w3c/navigation-timing#160. Every existing test asserts on
   redirectStart/redirectEnd/redirectCount directly — i.e. the channel that is protected — while the issue is about redirect timing being recoverable from timeOrigin regardless.

Passing everywhere (baseline, listed for completeness)

navigation-timing/nav2-test-redirect-xserver.html, nav2-test-redirect-chain-xserver-final-original-origin.html, nav2-test-redirect-chain-xserver-partial-opt-in.html, test-timing-xserver-redirect.html,
resource-timing/cross-origin-start-end-time-with-redirects.html, fetch-cross-origin-redirect.https.html, redirects.html.

Note the four xserver NavTiming tests only assert redirectCount === 0 / redirectStart === 0 for the non-opted-in case — they lock in the hiding behaviour, not the exposure, which is why they're green
while redirect-tao.html is not.