[Webkit-unassigned] [Bug 272682] New: Timing-Allow-Origin works with 302

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=272682

            Bug ID: 272682
           Summary: Timing-Allow-Origin works with 302
           Product: WebKit
           Version: Safari 17
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Page Loading
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jannis.rautenstrauch at cispa.de
                CC: beidson at apple.com

If a response with status code 302 sets a timing-allow-origin header, WebKit grants reading access (same as for status code 200).

Firefox and Chromium do not apply the timing-allow-origin header on a 302 response.
I am not sure if the specifications say anything about this edge case. As the other two implementations agree, I filed the bug here.

Example URL: https://sub.headers.websec.saarland/_hp/tests/perfAPI-tao.sub.html?resp_type=basic&browser_id=1&label=TAO&first_id=217&last_id=217&scheme=https&t_resp_id=217&t_element_relation=img_direct&t_resp_origin=https://headers.webappsec.eu
- Response with status code 302 sets 'timing-allow-origin: *'
- "requestStart != 0": true in WebKit
- "requestStart != 0": false in Firefox, Chromium

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240415/d064951c/attachment.htm>