Closed yoavweiss closed 1 year ago
^^ @crockercliff
Hi @abinpaul1
We were doing the security/privacy review of: https://github.com/abinpaul1/resource-timing/blob/render-blocking-status-explainer/Explainer/Render_Blocking_Status.md
It would help if you could add a section explaining why this isn't revealing new cross-origin information. You could also fill https://github.com/w3ctag/security-questionnaire
From my reading of the spec, it should be not reveal cross-origin information. The resources will be the ones fetched from <link>
,<script>
,<style>
elements with blocking="render" attribute. The information is already defined in the document.
What about resources nested inside an
Right now, it's hard to tell which resources were actually render blocking and which ones were not. Developers can try to heuristically guess that, based on when those resources were downloaded, but that's hard to do in the lab, never mind in the wild.
Lighthouse can now get rid of those heuristics, as Chromium provides a direct signal for render blocking resources (at least for scripts and styles).
It'd be good if RUM had similar capabilities, that would enable similar analysis by RUM providers:
And probably more...