Report fallback resource timing for no-TAO iframes #8643

noamr · 2022-12-22T06:34:59Z

When encountering a cross-origin iframe without TAO, don't automatically report its fetch start/end times, as that might expose user interaction with the iframe (a cross-origin violation).

Instead, report a fallback resource timing entry, with the navigation start time and the load event time of the iframe, which are already observable.

Depends on whatwg/fetch#1579
Closes w3c/resource-timing#340

At least two implementers are interested (and none opposed):
- Chromium
- WebKit
  -- [x] Tests are written and can be reviewed and commented upon at:
- Refactor nested-navigations resource-timing flow web-platform-tests/wpt#37810
Implementation bugs are filed:
- Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=1404695
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1809182
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=250322
- Deno (only for timers, structured clone, base64 utils, channel messaging, module resolution, web workers, and web storage): …
- Node.js (only for timers, structured clone, base64 utils, channel messaging, and module resolution): …
MDN issue is filed: Be more accurate about cross-origin protections mdn/content#23740

(See WHATWG Working Mode: Changes for more details.)

/browsing-the-web.html ( diff )
/iframe-embed-object.html ( diff )
/infrastructure.html ( diff )
/references.html ( diff )

This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5

This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4145963 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091970}

This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4145963 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091970}

…ing flow, a=testonly Automatic update from web-platform-tests Refactor nested-navigations resource-timing flow This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4145963 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091970} -- wpt-commits: 6cd6741bc20cd6b3ad9f95d19123b7850c696d79 wpt-pr: 37810

…ing flow, a=testonly Automatic update from web-platform-tests Refactor nested-navigations resource-timing flow This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4145963 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091970} -- wpt-commits: 6cd6741bc20cd6b3ad9f95d19123b7850c696d79 wpt-pr: 37810

Chromium change: https://chromium.googlesource.com/chromium/src/+/48762ae06d8de05d3dc8ef727d04eaa223901786 commit 48762ae06d8de05d3dc8ef727d04eaa223901786 Author: Noam Rosenthal <nrosenthal@chromium.org> Date: Thu Jan 12 19:08:43 2023 +0000 Refactor nested-navigations resource-timing flow This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579

When encountering a cross-origin iframe without TAO, don't automatically report its fetch start/end times, as that might expose user interaction with the iframe (a cross-origin violation). Instead, report a fallback resource timing entry, with the navigation start time and the load event time of the iframe, which are already observable. Depends on whatwg/fetch#1579 Closes w3c/resource-timing#340

Chromium change: https://chromium.googlesource.com/chromium/src/+/48762ae06d8de05d3dc8ef727d04eaa223901786 commit 48762ae06d8de05d3dc8ef727d04eaa223901786 Author: Noam Rosenthal <nrosenthal@chromium.org> Date: Thu Jan 12 19:08:43 2023 +0000 Refactor nested-navigations resource-timing flow This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579

domenic

Sorry this slipped through the cracks, let me try to fix the merge conflicts and merge.

…ing flow, a=testonly Automatic update from web-platform-tests Refactor nested-navigations resource-timing flow This changes how frames, iframes & objects decide how to report their navigations as resource timing entries to their parent: - Any frame-initiated navigation (e.g. iframe.src change) is reported as an entry. This complies with current spec. - For nested navigations that fail Timing-Allow-Origin, we don't report the normal responseEnd - instead we report the load event time as the responseEnd, to prevent leakage of navigation-related cross-origin information (see w3c/resource-timing#340) This incidentally fixes other existing issues with nested navigations and resource timing, such as flaky tests and inconsistencies regarding restored iframes. Bug: 1404695 Bug: 1348080 Bug: 1290721 Bug: 1380078 Bug: 1378015 Bug: 957181 Spec changes: whatwg/html#8643 whatwg/fetch#1579 Change-Id: I010b026788193cc77a7de3f3d75304602f41fcd5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4145963 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Commit-Queue: Noam Rosenthal <nrosenthal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091970} -- wpt-commits: 6cd6741bc20cd6b3ad9f95d19123b7850c696d79 wpt-pr: 37810

noamr mentioned this pull request Dec 22, 2022

Problematic cases with cross-origin iframes & aborted navigations w3c/resource-timing#340

Closed

noamr closed this Jan 3, 2023

noamr reopened this Jan 3, 2023

noamr force-pushed the rt-fallback-iframe branch from 99b8bf0 to 72b5fad Compare January 3, 2023 09:22

noamr changed the title ~~WIP: Report fallback resource timing for no-TAO iframes~~ Report fallback resource timing for no-TAO iframes Jan 3, 2023

noamr mentioned this pull request Jan 3, 2023

Don't automaticallly report resource timing for cross-origin TAO-fail… whatwg/fetch#1579

Closed

4 tasks

chromium-wpt-export-bot mentioned this pull request Jan 9, 2023

Refactor nested-navigations resource-timing flow web-platform-tests/wpt#37810

Merged

noamr force-pushed the rt-fallback-iframe branch from 72b5fad to 832a34d Compare February 2, 2023 04:45

noamr force-pushed the rt-fallback-iframe branch from 832a34d to 2d00be0 Compare February 2, 2023 04:47

whatwg deleted a comment from polarpsy94 Feb 3, 2023

domenic approved these changes Apr 6, 2023

View reviewed changes

domenic added 3 commits April 6, 2023 16:48

Merge branch 'main' into rt-fallback-iframe

436c859

Fix references section

d2700e9

Bad merge I think

d467c54

domenic added the topic: fetch label Apr 6, 2023

domenic merged commit 1279623 into whatwg:main Apr 6, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Report fallback resource timing for no-TAO iframes #8643

Report fallback resource timing for no-TAO iframes #8643

Uh oh!

noamr commented Dec 22, 2022 •

edited by pr-preview bot

Loading

Uh oh!

domenic left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Report fallback resource timing for no-TAO iframes #8643

Report fallback resource timing for no-TAO iframes #8643

Uh oh!

Conversation

noamr commented Dec 22, 2022 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

domenic left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

noamr commented Dec 22, 2022 •

edited by pr-preview bot

Loading