Server-Timing headers should be explicitly safelisted by CORS

... for access via fetch API. Accessing them from resource/navigation timing is protected by TAO. See whatwg/fetch#1511.
Tobias710219 · Jan 3, 2023 · 97518d5 · 97518d5
1 parent 97bb0e6
commit 97518d5
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/server-timing/resources/blue_cors.png b/server-timing/resources/blue_cors.png
diff --git a/server-timing/resources/blue_cors.png.headers b/server-timing/resources/blue_cors.png.headers
@@ -0,0 +1,2 @@
+Access-Control-Allow-Origin: *
+Server-Timing: metric2; dur=2.1; desc=blue.png
diff --git a/server-timing/server_timing_headers_not_visible_in_fetch.https.html b/server-timing/server_timing_headers_not_visible_in_fetch.https.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<head>
+    <meta charset='utf-8' />
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/common/get-host-info.sub.js"></script>
+    <script>
+      const {HTTPS_REMOTE_ORIGIN} = get_host_info()
+      promise_test(async t => {
+        const response = await fetch(`${HTTPS_REMOTE_ORIGIN}/server-timing/resources/blue_cors.png`, {mode: "cors"});
+        assert_equals(response.headers.has("server-timing"), false);
+      }, "Server-Timing headers should be explicitly allowed by CORS");
+    </script>
+</head>
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Access-Control-Allow-Origin: *
		Server-Timing: metric2; dur=2.1; desc=blue.png