Figure out if CORB can inject a net error instead of an empty body |
|||||
Issue descriptionFetch spec asks to block responses by injecting a net error. Example from https://fetch.spec.whatwg.org/#main-fetch: If response is not a network error and any of the following algorithms returns blocked, then set response and internalResponse to a network error: ... - should internalResponse to request be blocked due to nosniff It would be nice if CORB would be consistent with this aspect. Note that the difference between net-error-VS-empty-body might not be observable for some request destinations (e.g. for images). These destinations might therefore be less sensitive to the choice between net-error-VS-empty-body (and therefore we might start experimenting with these destinations first).
,
Mar 30 2018
nick@, would you mind if I assign it to you for now? I am not quite sure exactly how CrossSiteDocumentResourceHandler would need to be tweaked to inject a net error. Maybe we can chat about this in person next Tuesday.
,
Apr 11 2018
I've sketched this out, but after chatting with lukasz and charlie, I don't think we have as strong a motivation anymore to prefer a net error over an opaque filtered response. If we want to pursue it, the basic idea that seems to work is to call next_handler_->OnResponseCompleted() with a net error, but not report a net error to |controller|, like this: https://chromium-review.googlesource.com/c/chromium/src/+/996397/4/content/browser/loader/cross_site_document_resource_handler.cc Some issues: - The CL above seems to break the "blocked by CORB" console warning. - There's a risk that changes here would break the "detach the response so that it can stream to the cache" behavior. I think we need a test of this, which I'll pursue separately. Marking WontFix now, but if we decide to revisit this, hopefully there's enough information here to resume it.
,
May 21 2018
We got some more feedback (see https://github.com/whatwg/fetch/issues/727) and it seems to me that we should revisit the decision to inject an empty response VS a network error for responses blocked by CORB.
,
May 29 2018
Interestingly, CORB in Chromium *does* error out today if there is a DetachableResourceHandler present. This is quite accidental and unexpected. For a repro see the new CrossSiteDocumentBlockingTest.PrefetchIsNotImpacted test being added in https://crrev.com/c/1070601 - the test unexpectedly has to listen to link.onerror event (rather than to link.onload event).
,
Sep 26
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by lukasza@chromium.org
, Mar 30 2018