Thanks so much for this analysis; it's super helpful. Given that I'm not sure how to think about this, would you be willing to join the Weds API OWNERS call to discuss compat and strategies for mitigating risk?
Best, Alex On Thursday, October 15, 2026 at 1:51:31 AM UTC-7 Noam Rosenthal wrote: > For impact measurement, I ran an extensive http archive query: > https://gist.github.com/noamr/47ad2708f4fca6b0f2b462f70ca0c52a > > According to this query, 20% of cross-origin resources would gain body > sizes, and about 15% would lose body sizes. > When splitting by resource type, the variation is big though - e.g. > 20% of cross-origin images would lose body sizes and 2% would gain > body sizes. > The number for images would go down to ~12% if accounting for image > responses that already return a global CORS response > (Access-Control-Allow-Origin: *) without a CORS request (Origin: ...). > > I hope this data helps us make the right decision. > > > On Wed, Oct 14, 2026 at 5:11 PM Noam Rosenthal <[email protected]> > wrote: > > > > Important correction: Safari has not shipped this but supported the spec > change. > > Safari currently still supports body sizes only for same-origin. > > So currently each browser does something different for body sizes as > > seen in > https://wpt.fyi/results/resource-timing/body-size-cross-origin.https.html?label=master&label=experimental&aligned > . > > > > On Wed, Oct 14, 2026 at 4:44 PM Noam Rosenthal <[email protected]> > wrote: > > > > > > On Wed, Oct 14, 2026 at 4:27 PM Yoav Weiss (@Shopify) > > > <[email protected]> wrote: > > > > > > > > This will have significant compat implications. We need to think > carefully about this change. > > > > > > We already had this conversation as part of WebPerfWG in 2022. We've > > > standardized this and Gecko/WebKit have already shipped this. > > > Thinking carefully is always good but what exactly do you suggest? > > > > > > > On Wednesday, October 14, 2026 at 6:19:16 PM UTC+3 Alex Russell > wrote: > > > > > > > > I'm not convinced that it's so easy for developers to change this. > Can we do some outreach to see who might be impacted? > > > > > > > > > > > > I doubt outreach would help here. > > > > > > Agreed. We'll get the same feedback we received at WebPerfWG: > > > a) We don't like losing information > > > b) We don't have an alternative for the cross-origin leak. > > > > > > I think at this point we can either: > > > 1. ship it as is and live with missing encoded/decoded body sizes in > > > some scenarios. It doesn't drop actual timing information. > > > 2. drop it and live with the cross-origin leak and interop mismatch. > > > 3. investigate other avenues - this is currently not planned and it's > > > unclear what that would entail. > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/9e99e76b-f8c9-4b80-ac4f-84ea74270d23n%40chromium.org.
