mdn/content

Be more accurate about cross-origin protections

Open

#23,740 opened on 2023年1月18日

GitHub で見る
 (0 comments) (0 reactions) (0 assignees)Markdown (22,427 forks)batch import
Content:WebAPIarea: Performance APIeffort: mediumhelp wanted

Repository metrics

Stars
 (8,900 stars)
PR merge metrics
 (平均マージ 7d 3h) (30d で 147 merged PRs)

説明

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API

What specific section or headline is this issue about?

No response

What information was incorrect, unhelpful, or incomplete?

  • Timing-Allow-Origin is needed for CORS and no-cors, it's for cross-origin protection
  • In the case of cross-origin iframes, responseEnd might measure when the iframe finished loading completely with all its subresources, not just the main resource.
  • encoded/decoded body size are (soon to be) CORS-protected rather than TAO protected

What did you expect to see?

See above

Do you have any supporting links, references, or citations?

No response

Do you have anything more you want to share?

No response

MDN metadata

コントリビューターガイド