Closed
Bug 1754171
Opened 3 years ago
Closed 3 years ago
Resource Timing values leak opaque response redirect status
Categories
(Core :: Performance, defect, P3)
Core
Performance
Tracking
()
RESOLVED
DUPLICATE
of bug 1751678
People
(Reporter: tomvangoethem, Unassigned)
References
Details
(Keywords: privacy, sec-low)
According to the Fetch spec, the value of PerformanceResourceTiming.fetchStart
should be set to the request's start time for opaque responses. However, this value is set to the post-redirect start time (this should only be the case for non-opaque responses). The duration
property does use the request start time.
As a result it's possible to trivially determine whether a redirect occurred: redirected = responseEnd - fetchStart != duration
.
PoC:
async function isRedirected(url) {
const href = new URL(url).href;
const start = performance.now();
await fetch(href, {mode: "no-cors", credentials: "include" });
// Wait for request to be added to performance.getEntriesByName();
await new Promise(r => setTimeout(r, 200));
// Get last added timings
let res = performance.getEntriesByName(href).at(-1);
const diff = res.fetchStart - start;
console.log('diff', diff);
if(diff >= 1) return true
return false;
}
Comment 1•3 years ago
|
||
Sean, can you take a look at this?
Component: DOM: Networking → Performance
Flags: needinfo?(sefeng)
Updated•3 years ago
|
Group: core-security → dom-core-security
Comment 2•3 years ago
|
||
At a glance, it looks like this is a dupe of bug 1751678.
See Also: → CVE-2022-29915
Updated•3 years ago
|
Updated•3 years ago
|
Flags: needinfo?(sefeng)
Updated•3 years ago
|
Severity: -- → S2
Priority: -- → P3
Comment 4•3 years ago
|
||
This is indeed a dup of bug 1751678. Let's keep the conversation in one bug.
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(sefeng)
Resolution: --- → DUPLICATE
Updated•1 year ago
|
Group: dom-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•