Pass in content type to resource-timing #1481

abinpaul1 · 2022-08-22T15:00:00Z

These changes are to support addition of content type attribute to Perfomance resource timing. Further details are available at w3c/resource-timing#341

At least two implementers are interested (and none opposed):
- Chromium: https://chromestatus.com/feature/5156068351541248
- Mozilla: Content-type in Resource Timing mozilla/standards-positions#705
- Webkit (Pending) : Content-type in Resource Timing WebKit/standards-positions#88
Tests are written and can be reviewed and commented upon at:
- https://chromium-review.googlesource.com/c/chromium/src/+/3916841
- https://chromium-review.googlesource.com/c/chromium/src/+/4058549
Implementation bugs are filed:
- Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1366706
- Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1800443
- Safari: https://bugs.webkit.org/show_bug.cgi?id=247887
- Deno (not for CORS changes): …

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

fetch.bs

annevk · 2022-09-26T16:02:28Z

It also seems like we need to have w3c/server-timing#89 resolved before continuing here.

yoavweiss · 2022-09-27T06:48:13Z

It also seems like we need to have w3c/server-timing#89 resolved before continuing here.

@annevk the equivalent concerns related to this are currently handled in the ResourceTiming PR, essentially enabling user agents to trim entropy off of mime types to align them with a well-known list.

We tried to go off a well-known list of types in MIMESNIFF, but there seem to be types that have inherent entropy in their essence ("+zip" and "+xml" types specifically) which made that unreasonably hard.

So, I guess the open questions are:
a) Is implementation-defined trimming good enough from your perspective? Given that the concern doesn't have consensus around it, I thought this would be good enough.
b) Do you prefer the trimming to happen in Fetch rather than in RT?

/cc @achristensen07

annevk · 2022-09-27T06:56:12Z

I think it should happen in Fetch, if that is something that we plan on doing. I also think it should be standardized as it seems like it could be an interop hazard.

Could we perhaps normalize +zip to application/zip and +xml to application/xml and call it a day? And perhaps special case a few types such as image/svg+xml so they are preserved.

yoavweiss · 2022-10-20T11:48:29Z

I'm wary of pushing for a complex mechanism here, given that there's no consensus that w3c/server-timing#89 is indeed an issue. Does the fact that this would require CORS (rather than TAO) change the calculus on Apple's threat model?

annevk · 2022-10-21T09:00:15Z

@yoavweiss I think so, but then we also don't need stripping to just the essence, right? Not entirely clear to me how that relates to the "navigate"-related aspects of this PR, either.

yoavweiss · 2022-10-21T09:06:09Z

@yoavweiss I think so, but then we also don't need stripping to just the essence, right?

From my perspective, we don't need that (for neither this nor ServerTiming, which is TAO protected). I know that @achristensen07 disagrees with me on the ServerTiming/TAO aspects, but I'm not sure if he does on exposing such info to CORS enabled resources.

Not entirely clear to me how that relates to the "navigate"-related aspects of this PR, either.

For the "navigate" parts, they require same-origin, so I don't think @achristensen07's threat model applies there.

This CL introduces a contentType field to Performance Resource Timing object. This field is behind a Runtime Enabled Flag. Resource Timing PR : w3c/resource-timing#341 Fetch PR : whatwg/fetch#1481 Bug:1366706 Change-Id: If4c92ef96d74e3ddbb71420ac61dbea4bfa1163b

This CL introduces a contentType field to Performance Resource Timing object. This field is behind a Runtime Enabled Flag. Resource Timing PR : w3c/resource-timing#341 Fetch PR : whatwg/fetch#1481 Bug: 1366706 Change-Id: If4c92ef96d74e3ddbb71420ac61dbea4bfa1163b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3916841 Reviewed-by: Yoav Weiss <[email protected]> Reviewed-by: Mike West <[email protected]> Commit-Queue: Abin Paul <[email protected]> Cr-Commit-Position: refs/heads/main@{#1063289}

yoavweiss · 2022-11-08T14:33:44Z

@annevk - friendly ping! Do we need the essence stripping from your perspective?

annevk

Right, I agree we can expose this as-is. Content-Type is a safelisted response header when it comes to CORS.

fetch.bs

…iming, a=testonly Automatic update from web-platform-tests Add content-type to PerformanceResourceTiming This CL introduces a contentType field to Performance Resource Timing object. This field is behind a Runtime Enabled Flag. Resource Timing PR : w3c/resource-timing#341 Fetch PR : whatwg/fetch#1481 Bug: 1366706 Change-Id: If4c92ef96d74e3ddbb71420ac61dbea4bfa1163b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3916841 Reviewed-by: Yoav Weiss <[email protected]> Reviewed-by: Mike West <[email protected]> Commit-Queue: Abin Paul <[email protected]> Cr-Commit-Position: refs/heads/main@{#1063289} -- wpt-commits: 4c8e480994182b5cdc60f5c01ebf208df70ec73e wpt-pr: 36059

fetch.bs

annevk · 2022-11-14T15:42:58Z

@abinpaul1 looking at the Chromium patch it strikes me that it might not do MIME type parsing currently. I think it would be good if we had test coverage for that. https://github.com/web-platform-tests/wpt/tree/master/fetch/content-type has some existing tests you might be able to reuse.

I'm also gonna push a small fixup commit for an existing formatting issue in the <dl> list.

…iming, a=testonly Automatic update from web-platform-tests Add content-type to PerformanceResourceTiming This CL introduces a contentType field to Performance Resource Timing object. This field is behind a Runtime Enabled Flag. Resource Timing PR : w3c/resource-timing#341 Fetch PR : whatwg/fetch#1481 Bug: 1366706 Change-Id: If4c92ef96d74e3ddbb71420ac61dbea4bfa1163b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3916841 Reviewed-by: Yoav Weiss <[email protected]> Reviewed-by: Mike West <[email protected]> Commit-Queue: Abin Paul <[email protected]> Cr-Commit-Position: refs/heads/main@{#1063289} -- wpt-commits: 4c8e480994182b5cdc60f5c01ebf208df70ec73e wpt-pr: 36059

abinpaul1 · 2022-11-30T23:46:27Z

@annevk Added tests for checking the parsing over at https://chromium-review.googlesource.com/c/chromium/src/+/4058549.
Please have a look

annevk · 2022-12-01T10:50:23Z

@abinpaul1 I didn't realize that directory doesn't test a bunch of the error cases around MIME type handling. It's essentially only handling the Content-Type charset parameter defaulting. It still seems good though, but maybe add https://github.com/web-platform-tests/wpt/blob/master/mimesniff/mime-types/resources/mime-types.json to the mix?

However, it also seems like you're expecting the wrong thing. It should be the mimeType field, not documentContentType, right?

abinpaul1 · 2022-12-01T22:44:28Z

It still seems good though, but maybe add https://github.com/web-platform-tests/wpt/blob/master/mimesniff/mime-types/resources/mime-types.json to the mix?

I've tried to include those as well now. Please have another look

However, it also seems like you're expecting the wrong thing. It should be the mimeType field, not documentContentType, right?

Yeah. Changed to mimeType field.

annevk · 2022-12-02T14:41:07Z

Thanks, that looks good. For the problem you're running into with mime-types.json, I recommend taking a look at the README https://github.com/web-platform-tests/wpt/tree/master/mimesniff/mime-types (or one of the tests using it).

abinpaul1 · 2022-12-03T22:47:06Z

Thanks again for the pointers. Updated the tests now (extra checks similar to charset-parameter.window.js#L41 before running the test case from json.

annevk

This looks good. At this point we need either Gecko or WebKit to support this change.

yoavweiss · 2023-04-11T11:01:36Z

Seems like Gecko are now supportive.

RByers · 2023-04-25T14:53:08Z

Is there anything still blocking this PR from landing?

annevk · 2023-04-27T14:30:31Z

Apologies for the delay here. I was out the last couple weeks and only just circled back with Alex about his objection to this feature. I laid out a path forward in WebKit/standards-positions#88 (comment) that I'm prepared to help with. Feedback from you all as well as @zcorpan @bdekoz @sefeng211 appreciated.

See WebKit/standards-positions#88 (comment) for rationale. whatwg/fetch#1481 will be updated to call this.

annevk · 2023-04-27T15:13:55Z

I put up whatwg/mimesniff#171 which we could call here so the least amount of information leaves the network layer. Seems cleanest. That would require a slight restructuring, but nothing too bad and it would make the Resource Timing side very straightforward.

@yoavweiss indicated support in WebKit/standards-positions#88 (comment). Once I've had review of the MIME Sniffing PR I would be happy to update this PR as well and provide instructions for the Resource Timing PR.

See WebKit/standards-positions#88 (comment) for rationale. whatwg/fetch#1481 will be updated to call this.

This defines the content type field as a minimized version of the response's parsed Content-Type header, to give web developers enough information to distinguish responses, but not enough to make it an additional communication channel. This feature will be used by Resource Timing as per w3c/resource-timing#341. Tests: ...

annevk · 2023-05-04T15:32:14Z

@abinpaul1 I updated this to account for the MIME Sniffing change (doesn't pass CI yet due to indexing, probably tomorrow). Will you update the tests?

abinpaul1 · 2023-05-04T21:34:40Z

@annevk Yeah..I can do that. Couple of things I wanted to clarify before updating the same.

Since we now mininimize before returning, I guess the tests we added for checking the content-type parsing can't be kept, right?
As part of the new tests, I believe it would be easy to test for javascript, XML, JSON types because we define consistent behaviour , however how do we test for other types say image/png that fall under - If mimeType is supported by the user agent, then return mimeType's essence?

fetch.bs

annevk · 2023-05-05T05:28:39Z

@abinpaul1 I think we could add a minimizedMIMEType member. In particular for https://github.com/web-platform-tests/wpt/blob/master/mimesniff/mime-types/resources/mime-types.json that seems good. But there need to be new tests as well, yes. It might well make sense to create a JSON resource specifically for inputs and outputs of the minimized algorithm.

For types that fall into the "is supported by" conditional, I suggest we stick with types we know all browsers implement. And keep types that are in the process of being standardized/implemented in a tentative file or some such.

Also, did we have cross-origin tests already? If not we probably should have some as well, even if only for images and scripts or some such.

abinpaul1 · 2023-05-08T00:58:29Z

@annevk

I've updated the tests here : https://chromium-review.googlesource.com/c/chromium/src/+/4509283

And keep types that are in the process of being standardized/implemented in a tentative file or some such.

I'm not sure if I know which types are being standardized and have to be included as tentative. Would it make sense for us to just add them to the JSON for the minimized algorithm tests later when they do become standardized ?

Also, did we have cross-origin tests already? If not we probably should have some as well, even if only for images and scripts or some such.

I think these were covered in content-type.html - 1 and 2

annevk · 2023-05-08T09:28:05Z

That seems fine, but e.g., you could assume "image/png" is always supported.

abinpaul1 marked this pull request as draft August 22, 2022 15:00

abinpaul1 mentioned this pull request Aug 22, 2022

Add content-type to resource-timing w3c/resource-timing#341

Merged

yoavweiss reviewed Aug 30, 2022

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

abinpaul1 force-pushed the content-type branch from 9c9e580 to b4299c2 Compare September 2, 2022 16:31

abinpaul1 force-pushed the content-type branch from b4299c2 to b9f7ba9 Compare September 11, 2022 13:47

abinpaul1 marked this pull request as ready for review September 22, 2022 08:01

abinpaul1 changed the title ~~[draft] Pass in content type to resource-timing~~ Pass in content type to resource-timing Sep 22, 2022

annevk reviewed Sep 26, 2022

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

annevk added security/privacy There are security or privacy implications topic: timing Issues and PR that touch on the infrastructure that is used by ResourceTiming, NavigationTiming, etc labels Sep 26, 2022

chromium-wpt-export-bot mentioned this pull request Oct 24, 2022

Add content-type to PerformanceResourceTiming web-platform-tests/wpt#36059

Merged

abinpaul1 force-pushed the content-type branch 2 times, most recently from 9cb87bf to 9dab8eb Compare November 7, 2022 17:42

annevk reviewed Nov 10, 2022

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

abinpaul1 force-pushed the content-type branch from 9dab8eb to 4086857 Compare November 12, 2022 15:26

annevk reviewed Nov 14, 2022

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

fetch.bs Outdated Show resolved Hide resolved

abinpaul1 force-pushed the content-type branch 2 times, most recently from c231b11 to 948dc1b Compare November 14, 2022 11:39

annevk mentioned this pull request Nov 14, 2022

Content-type in Resource Timing WebKit/standards-positions#88

Closed

annevk approved these changes Dec 8, 2022

View reviewed changes

annevk added a commit to whatwg/mimesniff that referenced this pull request Apr 27, 2023

Add minimize a supported MIME type for Fetch and Resource Timing

a720e70

See WebKit/standards-positions#88 (comment) for rationale. whatwg/fetch#1481 will be updated to call this.

annevk mentioned this pull request Apr 27, 2023

Add minimize a supported MIME type for Fetch and Resource Timing whatwg/mimesniff#171

Merged

4 tasks

annevk added a commit to whatwg/mimesniff that referenced this pull request May 4, 2023

Add minimize a supported MIME type for Fetch and Resource Timing

227a469

See WebKit/standards-positions#88 (comment) for rationale. whatwg/fetch#1481 will be updated to call this.

annevk force-pushed the content-type branch from d529473 to 81caaba Compare May 4, 2023 15:30

annevk reviewed May 5, 2023

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

add null check

7631a87

annevk added the needs tests Moving the issue forward requires someone to write tests label May 5, 2023

annevk approved these changes May 8, 2023

View reviewed changes

annevk removed the needs tests Moving the issue forward requires someone to write tests label May 8, 2023

annevk merged commit 931cd06 into whatwg:main May 8, 2023

horo-t mentioned this pull request Mar 25, 2024

Expose Content-Encoding to resource-timing w3c/resource-timing#385

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pass in content type to resource-timing #1481

Pass in content type to resource-timing #1481

abinpaul1 commented Aug 22, 2022 •

edited by pr-preview bot

Loading

annevk commented Sep 26, 2022

yoavweiss commented Sep 27, 2022

annevk commented Sep 27, 2022

yoavweiss commented Oct 20, 2022

annevk commented Oct 21, 2022

yoavweiss commented Oct 21, 2022

yoavweiss commented Nov 8, 2022

annevk left a comment

annevk commented Nov 14, 2022

abinpaul1 commented Nov 30, 2022

annevk commented Dec 1, 2022 •

edited

Loading

abinpaul1 commented Dec 1, 2022 •

edited

Loading

annevk commented Dec 2, 2022

abinpaul1 commented Dec 3, 2022

annevk left a comment •

edited

Loading

yoavweiss commented Apr 11, 2023

RByers commented Apr 25, 2023

annevk commented Apr 27, 2023

annevk commented Apr 27, 2023

annevk commented May 4, 2023

abinpaul1 commented May 4, 2023

annevk commented May 5, 2023

abinpaul1 commented May 8, 2023

annevk commented May 8, 2023

Pass in content type to resource-timing #1481

Pass in content type to resource-timing #1481

Conversation

abinpaul1 commented Aug 22, 2022 • edited by pr-preview bot Loading

annevk commented Sep 26, 2022

yoavweiss commented Sep 27, 2022

annevk commented Sep 27, 2022

yoavweiss commented Oct 20, 2022

annevk commented Oct 21, 2022

yoavweiss commented Oct 21, 2022

yoavweiss commented Nov 8, 2022

annevk left a comment

Choose a reason for hiding this comment

annevk commented Nov 14, 2022

abinpaul1 commented Nov 30, 2022

annevk commented Dec 1, 2022 • edited Loading

abinpaul1 commented Dec 1, 2022 • edited Loading

annevk commented Dec 2, 2022

abinpaul1 commented Dec 3, 2022

annevk left a comment • edited Loading

Choose a reason for hiding this comment

yoavweiss commented Apr 11, 2023

RByers commented Apr 25, 2023

annevk commented Apr 27, 2023

annevk commented Apr 27, 2023

annevk commented May 4, 2023

abinpaul1 commented May 4, 2023

annevk commented May 5, 2023

abinpaul1 commented May 8, 2023

annevk commented May 8, 2023

abinpaul1 commented Aug 22, 2022 •

edited by pr-preview bot

Loading

annevk commented Dec 1, 2022 •

edited

Loading

abinpaul1 commented Dec 1, 2022 •

edited

Loading

annevk left a comment •

edited

Loading