TAO is not fully aligned with ACAO

w3c / server-timing

Server Timing

http://w3c.github.io/server-timing/

Other

75 stars 20 forks source link

TAO is not fully aligned with ACAO #63

Closed youennf closed 5 years ago

youennf commented 5 years ago

ACAO does not allow credentials to be used for value '*'. There is no similar constraint for TAO. The Origin header might not always be set in a given request so this makes it harder to always provide a specific information for TAO in the response.

That said, servers using '' might be at bigger risk, say in case of no-cors/credential loads. Should '' use be forbidden in case of credentials? Should there be wording in the spec discouraging to use '*'?

yoavweiss commented 5 years ago

This sounds highly related to https://github.com/w3c/resource-timing/issues/178 and not necessarily Server Timing specific. Is that correct?

youennf commented 5 years ago

Oh right, it should be a resource-timing issue not a server timing one. Let's close this one then.