search

mozilla / standards-positions

https://mozilla.github.io/standards-positions/
Mozilla Public License 2.0
650 stars 72 forks source link

ResourceTiming - deliveryType #824

Open jeremyroman opened 1 year ago

jeremyroman commented 1 year ago

Request for Mozilla Position on an Emerging Web Specification

Other information

The Resource Timing text currently only covers "" and "cache".

Chromium also implements "navigational-prefetch" as part of https://wicg.github.io/nav-speculation/prefetch.html (currently behind a flag). Some of that work might be covered by https://github.com/mozilla/standards-positions/issues/620.

zcorpan commented 1 year ago

cc @bdekoz @bgrins

smaug---- commented 1 year ago

How is this not revealing something new about user's browsing behavior, in other words, why is this not a privacy issue?

jeremyroman commented 1 year ago

In the case of "cache", it is subject to whatever cache partitioning scheme the UA uses (e.g., if the cache is partitioned by top-level site, it doesn't reveal anything about browsing on other sites). Additionally, this is subject to the same protections as transferSize, which exposes the cache mode (0 implies local, 300 implies validated, any value above 300 implies uncached). transferSize and deliveryType are also subject to the same Timing-Allow-Origin check.

In the case of prefetch, browsers already send request headers indicating that a request is for prefetch, and servers could modify their response depending on this header.