PerformanceResourceTiming: TimingAllowCheck

[avadacatavra]

Spec: https://w3c.github.io/resource-timing/#dfn-timing-allow-check

The timing allow check algorithm, which checks whether a resource's timing information can be shared with the current document, is as follows:

1. If the resource is same origin, return pass.
2. If the Timing-Allow-Origin header value list contains a case-sensitive match for the value of the origin of the current document, or a wildcard ("*"), return pass.
3. Return fail.

If the last non-redirected fetch of the resource fails the timing allow check, the user agent MUST set redirectStart, redirectEnd, domainLookupStart, domainLookupEnd, connectStart, connectEnd, requestStart, responseStart and secureConnectionStart to zero

This check can also affect startTime.

[tdelacour]

@highfive assign me

[highfive]

Hey @tdelacour! Thanks for your interest in working on this issue. It's now assigned to you!

[jdm]

Are you still working on this @tdelacour?

[tdelacour]

@jdm sorry, I've had a busy couple of weeks and have been squatting on this one! Hoping to get some time after the end of this week, but maybe un-assign me for now & I'll pick it up again in a bit if it's still available?

[RestitutorOrbis]

I'd be interested in this. Although, I probably won't get to it for another week or two.

[jdm]

Leave a comment when you're ready to start looking at it, in that case :)

[RestitutorOrbis]

Cool, will do. Thanks!

[oneturkmen]

@jdm @RestitutorOrbis Javed, if you change your mind, I'd love to take this task.

[RestitutorOrbis]

@highfive assign me. I'm good to take this on now.

[highfive]

Hey @RestitutorOrbis! Thanks for your interest in working on this issue. It's now assigned to you!

[RestitutorOrbis]

@jdm What files should I take a look at to take on this issue?

[jdm]

@RestitutorOrbis I would expect this to affect:

• https://github.com/servo/servo/blob/master/components/net/http_loader.rs (we will need to implement step 9 of https://w3c.github.io/resource-timing/#processing-model after the response's headers have been received)
• https://github.com/servo/servo/blob/master/components/net_traits/lib.rs (we will need to add a flag to ResourceFetchTiming that indicates if the timing check passed, and only update timing attributes if that flag is false)

[RestitutorOrbis]

@jdm Just to confirm, for http_loader.rs, I should be looking at the function obtain_response and I need to write my timing allow check to run anytime after the call to "request_headers.clone()". Does that sound reasonable?

[jdm]

Anytime after this code is when the response headers will be available, which are the ones that can contain the HTTP headers about allowing the Timing-Allow-Origin response header.

[RestitutorOrbis]

@jdm Which tests in https://github.com/servo/servo/tree/master/tests/wpt/web-platform-tests/resource-timing are relevant? Is it just resource-timing/resource_TAO_origin.htm, resource-timing/resource_TAO_zero.htm, and resource-timing/TAO-crossorigin-port.sub.html?

[jdm]

I would expect any of the tests with TAO in the name to be relevant.