For impact measurement, I ran an extensive http archive query: https://gist.github.com/noamr/47ad2708f4fca6b0f2b462f70ca0c52a
According to this query, 20% of cross-origin resources would gain body sizes, and about 15% would lose body sizes. When splitting by resource type, the variation is big though - e.g. 20% of cross-origin images would lose body sizes and 2% would gain body sizes. The number for images would go down to ~12% if accounting for image responses that already return a global CORS response (Access-Control-Allow-Origin: *) without a CORS request (Origin: ...). I hope this data helps us make the right decision. On Wed, Oct 14, 2026 at 5:11 PM Noam Rosenthal <[email protected]> wrote: > > Important correction: Safari has not shipped this but supported the spec > change. > Safari currently still supports body sizes only for same-origin. > So currently each browser does something different for body sizes as > seen in > https://wpt.fyi/results/resource-timing/body-size-cross-origin.https.html?label=master&label=experimental&aligned. > > On Wed, Oct 14, 2026 at 4:44 PM Noam Rosenthal <[email protected]> > wrote: > > > > On Wed, Oct 14, 2026 at 4:27 PM Yoav Weiss (@Shopify) > > <[email protected]> wrote: > > > > > > This will have significant compat implications. We need to think > > > carefully about this change. > > > > We already had this conversation as part of WebPerfWG in 2022. We've > > standardized this and Gecko/WebKit have already shipped this. > > Thinking carefully is always good but what exactly do you suggest? > > > > > On Wednesday, October 14, 2026 at 6:19:16 PM UTC+3 Alex Russell wrote: > > > > > > I'm not convinced that it's so easy for developers to change this. Can we > > > do some outreach to see who might be impacted? > > > > > > > > > I doubt outreach would help here. > > > > Agreed. We'll get the same feedback we received at WebPerfWG: > > a) We don't like losing information > > b) We don't have an alternative for the cross-origin leak. > > > > I think at this point we can either: > > 1. ship it as is and live with missing encoded/decoded body sizes in > > some scenarios. It doesn't drop actual timing information. > > 2. drop it and live with the cross-origin leak and interop mismatch. > > 3. investigate other avenues - this is currently not planned and it's > > unclear what that would entail. -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAJn%3DMYYMRqQVAFH_jLBktvdt%3Dov5jnB%2B7H-jLm58%3DUEFfjfpNw%40mail.gmail.com.
