Cross-origin read blocking, better known as CORB, is an algorithm by which dubious cross-origin resource fetches are identified and blocked before they reach a web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages. In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks. More info: - Explainer: https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md - WhatWG issue: https://github.com/whatwg/fetch/issues/681 - PR for Fetch spec changes: https://github.com/whatwg/fetch/pull/686 - Initial public support from Firefox: https://groups.google.com/a/chromium.org/forum/#!msg/site-isolation-dev/pp5C8XKz7AI/2zNOn-S_BgAJ
FYI: I'm about to land the Fetch PR. It standardizes all the bits of CORB that can be implemented without sniffing the response. Tests can be found in fetch/corb in web-platform-tests.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.