Skip to content

Using navigationStart as a baseline may expose cross-origin timing information #160

Open
@noamr

Description

@noamr

When we have a navigation with cross-origin redirects, we're hiding redirectStart and redirectEnd from the final document.

However, because the timeOrigin for all the navigation timing entries is the navigation start, the redirect timing info can (somewhat) easily be inferred.

Consider the following:

  • User clicks a link to domain A at timestamp ts1 (e.g. a search engine click handler URL or an ad broker like outbrain)
  • Domain A takes a while to handle the request
  • The request redirects to domain B at timestamp ts2
  • Domain B handles the request and serves the document
  • ts1 is available to the document, directly or indirectly, as it's the navigationStart which is the base timestamp for all navigation timing / resource timing entries (as well as the timeOrigin).

I believe we have three ways to go about it (but maybe there are more):

  • Enable all the navigation timing properties, based on the notion that the cross-origin information is already exposed by navigationStart.
  • Change navigationStart to be the timestamp of the first redirect in the current origin redirect chain
  • Make use of TAO (in its current form or with some amendments) to give redirect chains the opportunity to expose their timing to the destination.

This came from discussing whether to enable or zero-out navigation timing properties.
See previous discussions here, here and here.

Thoughts?`

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions