Skip to content

Clarify informative notes about cross-origin #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
noamr merged 4 commits into from
Feb 17, 2026
Merged

Clarify informative notes about cross-origin #424

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1ff5ac2
Clarify informative notes about cross-origin
noamr Feb 10, 2026
72122db
Add links to fetch
noamr Feb 10, 2026
6be3d8c
encoded
noamr Feb 10, 2026
6e1649a
Revert "encoded"
noamr Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
167 changes: 102 additions & 65 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,20 +66,20 @@
github: "https://github.com/w3c/resource-timing/",
caniuse: "resource-timing",
xref: {
specs: ["hr-time-3", "performance-timeline", "service-workers" ,"xhr"],
specs: ["hr-time-3", "performance-timeline", "service-workers", "xhr"],
profile: "web-platform",
},
},

localBiblio: {
INCREMENTAL_FONT_TRANSFER: {
title: "Incremental Font Transfer",
href: "https://www.w3.org/TR/IFT/",
localBiblio: {
INCREMENTAL_FONT_TRANSFER: {
title: "Incremental Font Transfer",
href: "https://www.w3.org/TR/IFT/",
},
EARLY_HINTS: {
title: "Early hints",
href: "https://httpwg.org/specs/rfc8297.html",
}
},
EARLY_HINTS: {
title: "Early hints",
href: "https://httpwg.org/specs/rfc8297.html",
}
},

};
</script>
Expand Down Expand Up @@ -458,20 +458,21 @@ <h3>
<code>"body"</code>, if the request is a result of processing the
[^body^] element's <code>background</code> attribute that's
already obsolete.
</li>
<li>
<p>
</li>
<li>
<p>
<code>"css"</code>, if the request is a result of processing a
CSS <a data-cite="css-values-4" data-xref-type=
"css-function">url()</a> directive such as <code>@import
url()</code> or <code>background: url()</code>; [[CSS-VALUES]]
</p>
<p>
Note: the request for a font resource specified with
<code>@font-face</code> in CSS is a result of processing a CSS
directive. Therefore, the `initiatorType` for this font
resource is <code>"css"</code>.
</p>
CSS <a data-cite="css-values-4" data-xref-type="css-function">url()</a> directive such as <code>@import
url()</code> or
<code>background: url()</code>;
[[CSS-VALUES]]
</p>
<p>
Note: the request for a font resource specified with
<code>@font-face</code> in CSS is a result of processing a CSS
directive. Therefore, the `initiatorType` for this font
resource is <code>"css"</code>.
</p>
</li>
<li>
<code>"script"</code>, if the request is a result of loading any
Expand All @@ -486,8 +487,8 @@ <h3>
<code>"font"</code>, if the request is the result of processing
fonts. This can happen when fonts request subsequent resources,
e.g, when [[[INCREMENTAL_FONT_TRANSFER]]] is used.
</li>
<li>
</li>
<li>
<code>"fetch"</code>, if the request is the result of processing
the {{WindowOrWorkerGlobalScope/fetch()}} method;
</li>
Expand Down Expand Up @@ -535,20 +536,20 @@ <h3>
<li>
<code>"embed"</code>, if the request is the result of processing
an [^embed^] element's [^embed/src^].
</li>
<li>
<code>"link"</code>, if the request is the result of processing
an [^link^] element.
</li>
<li>
<code>"object"</code>, if the request is the result of processing
an [^object^] element.
</li>
<li>
<code>"early-hints"</code>, if the request is the result of
processing an [[[EARLY_HINTS]]] response.
</li>
<li>
</li>
<li>
<code>"link"</code>, if the request is the result of processing
an [^link^] element.
</li>
<li>
<code>"object"</code>, if the request is the result of processing
an [^object^] element.
</li>
<li>
<code>"early-hints"</code>, if the request is the result of
processing an [[[EARLY_HINTS]]] response.
</li>
<li>
<code>"other"</code>, if none of the above conditions match.
</li>
</ul>
Expand Down Expand Up @@ -768,9 +769,9 @@ <h3>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>contentEncoding</dfn> getter steps are to return
<a>this</a>'s <a data-for="PerformanceResourceTiming">resource
info</a> 's [=response body info/content encoding=].
</p>
<p data-dfn-for="PerformanceResourceTiming">
info</a> 's [=response body info/content encoding=].
</p>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>renderBlockingStatus</dfn> getter steps are to return
<a data-link-for="RenderBlockingStatusType">blocking</a> if
<a>this</a>'s <a data-for="PerformanceResourceTiming">timing
Expand All @@ -780,25 +781,25 @@ <h3>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>workerRouterEvaluationStart</dfn> getter steps are to return
<a>this</a>'s <a data-for="PerformanceResourceTiming">timing
info</a>'s [=fetch timing info/service worker timing info=]'s
info</a>'s [=fetch timing info/service worker timing info=]'s
[=service worker timing info/worker router evaluation start=].
</p>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>workerCacheLookupStart</dfn> getter steps are to return
<a>this</a>'s <a data-for="PerformanceResourceTiming">timing
info</a>'s [=fetch timing info/service worker timing info=]'s
info</a>'s [=fetch timing info/service worker timing info=]'s
[=service worker timing info/worker cache lookup start=].
</p>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>workerMatchedRouterSource</dfn> getter steps are to return
<a>this</a>'s <a data-for="PerformanceResourceTiming">timing
info</a>'s [=fetch timing info/service worker timing info=]'s
info</a>'s [=fetch timing info/service worker timing info=]'s
[=service worker timing info/worker matched router source=].
</p>
<p data-dfn-for="PerformanceResourceTiming">
The <dfn>workerFinalRouterSource</dfn> getter steps are to return
<a>this</a>'s <a data-for="PerformanceResourceTiming">timing
info</a>'s [=fetch timing info/service worker timing info=]'s
info</a>'s [=fetch timing info/service worker timing info=]'s
[=service worker timing info/worker final router source=].
</p>
<p class='note'>
Expand Down Expand Up @@ -1043,18 +1044,25 @@ <h3>
<h3>
Cross-origin Resources
</h3>
<p class="note" data-dfn-for="PerformanceResourceTiming">
As detailed in [=Fetch=], requests for cross-origin resources are
included as <a>PerformanceResourceTiming</a> objects in the
<a data-cite=
"PERFORMANCE-TIMELINE-2#performance-timeline">Performance
Timeline</a>. If the <a data-cite="FETCH#concept-tao-check">timing
allow check</a> algorithm fails for a cross-origin resource, the
<h4>
Introduction
</h4>
<p>
This section is non-normative.
</p>

As detailed in [=Fetch=], requests for cross-origin resources are
included as <a>PerformanceResourceTiming</a> objects in the
<a data-cite="PERFORMANCE-TIMELINE-2#performance-timeline">Performance
Timeline</a>.
<p>
If the <a data-cite="FETCH#concept-tao-check">timing
allow check</a> algorithm fails for a cross-origin resource, the
entry will be an [=create an opaque timing info|opaque entry=]. Such
entries have most of their attributes masked in order to prevent
leaking cross-origin data that isn't otherwise exposed. So, for an
[=create an opaque timing info|opaque entry=], the following
attributes will be set to zero:
attributes will always return zero or the empty string:
{{PerformanceResourceTiming/redirectStart}},
{{PerformanceResourceTiming/redirectEnd}},
{{PerformanceResourceTiming/workerStart}},
Expand All @@ -1066,23 +1074,52 @@ <h3>
{{PerformanceResourceTiming/firstInterimResponseStart}},
{{PerformanceResourceTiming/finalResponseHeadersStart}},
{{PerformanceResourceTiming/responseStart}},
{{PerformanceResourceTiming/secureConnectionStart}},
{{PerformanceResourceTiming/transferSize}},
{{PerformanceResourceTiming/encodedBodySize}}, and
{{PerformanceResourceTiming/decodedBodySize}}. Further, the
{{PerformanceResourceTiming/nextHopProtocol}} attribute will be set
to the empty string.
{{PerformanceResourceTiming/secureConnectionStart}}, and {{PerformanceResourceTiming/nextHopProtocol}}.
</p>
<p>
Server-side applications may return the <a>Timing-Allow-Origin</a>
HTTP response header to allow the User Agent to fully expose, to the
document origin(s) specified, the values of attributes that would
have been zero due to those cross-origin restrictions.
Some of the properties, like {{PerformanceResourceTiming/contentType}},
{{PerformanceResourceTiming/encodedBodySize}}, and
{{PerformanceResourceTiming/decodedBodySize}} are set to zero (or the empty string in the case of
{{PerformanceResourceTiming/contentType}}) when the response is <a
data-cite="HTML#cors-cross-origin">CORS-cross-origin</a>.
Comment thread
yoavweiss marked this conversation as resolved.

{{PerformanceResourceTiming/transferSize}} is affected both by the <a data-cite="FETCH#concept-tao-check">timing
allow check</a> and by the <a data-cite="HTML#cors-cross-origin">CORS-cross-origin</a> status.
</p>

<p>
For requests handled by a [=service worker=] using {{FetchEvent/respondWith()}}, the reported timing data reflects the
interaction between
the client and the service worker,
rather than the service worker's own internal network activity.
For example, the service worker might respond to a same-origin request with a cross-origin response or vice versa,
or return a cached or synthetic response to either.
Given that, resources forwarded from a service worker do not tell the whole story
of fetching the resource, and do not go through the <a data-cite="FETCH#concept-tao-check">timing
allow check</a>.
To get the full information about those fetches, the service worker's own performance timeline
can be inspected. [[SERVICE-WORKERS]]
Comment thread
noamr marked this conversation as resolved.

<p>
For more details, see <a data-cite="FETCH#concept-http-fetch">HTTP Fetch</a> #4 - the <a
data-cite="FETCH#concept-tao-check">timing
allow check</a> is only performed when there is no response from the service worker.
In addition, the [=response=] cloned in the {{FetchEvent/respondWith()}} algorithm does not carry the [=/fetch timing
info=]
of the internal fetch, as that information is attached to a fetch rather than to a [=response=].
</p>
</p>
</section>
<section id="sec-timing-allow-origin">
<h4>
<code>Timing-Allow-Origin</code> Response Header
</h4>
<p>
Server-side applications may return the <a>Timing-Allow-Origin</a>
HTTP response header to allow the User Agent to fully expose, to the
document origin(s) specified, the values of attributes that would
have been zero due to those cross-origin restrictions.
</p>
<p>
The <dfn>Timing-Allow-Origin</dfn> HTTP response header field can
be used to communicate a policy indicating origin(s) that may be
Expand Down