Be more accurate about cross-origin protections

[noamr]

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API

What specific section or headline is this issue about?

No response

What information was incorrect, unhelpful, or incomplete?

• Timing-Allow-Origin is needed for CORS and no-cors, it's for cross-origin protection
• In the case of cross-origin iframes, responseEnd might measure when the iframe finished loading completely with all its subresources, not just the main resource.
• encoded/decoded body size are (soon to be) CORS-protected rather than TAO protected

What did you expect to see?

See above

Do you have any supporting links, references, or citations?

No response

Do you have anything more you want to share?

No response

MDN metadata

Page report details

• Folder: en-us/web/api/resource_timing_api
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API
• GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/api/resource_timing_api/index.md
• Last commit: 66c9543
• Document last modified: 2022-11-05T00:48:48.000Z