1754171 - Resource Timing values leak opaque response redirect status

Status: RESOLVED DUPLICATE of bug 1751678

(Core :: Performance, defect, P3)

Description

[Tom Van Goethem]

According to the Fetch spec, the value of PerformanceResourceTiming.fetchStart should be set to the request's start time for opaque responses. However, this value is set to the post-redirect start time (this should only be the case for non-opaque responses). The duration property does use the request start time.
As a result it's possible to trivially determine whether a redirect occurred: redirected = responseEnd - fetchStart != duration.

PoC:

async function isRedirected(url) {  
    const href = new URL(url).href;
    const start = performance.now();
    await fetch(href, {mode: "no-cors", credentials: "include" });
    // Wait for request to be added to performance.getEntriesByName();
    await new Promise(r => setTimeout(r, 200));
    // Get last added timings
    let res = performance.getEntriesByName(href).at(-1);
    const diff = res.fetchStart - start;
    console.log('diff', diff);
    if(diff >= 1) return true
    return false;
}

Comment 1

[Anne (:annevk)]

Sean, can you take a look at this?

Comment 2

[Andrew McCreight [:mccr8]]

At a glance, it looks like this is a dupe of bug 1751678.

Comment 3

[Sean Feng [:sefeng]]

Accidentally cleared my NI

Comment 4

[Sean Feng [:sefeng]]

This is indeed a dup of bug 1751678. Let's keep the conversation in one bug.