{"action":"created","comment":{"url":"https://api.github.com/repos/whatwg/fetch/pulls/comments/186453421","pull_request_review_id":118026647,"id":186453421,"diff_hunk":"@@ -2354,6 +2354,55 @@ X-Content-Type-Options           = \"nosniff\" ; case-insensitive</pre>\n pertain to them. Also, considering \"<code>image</code>\" was not compatible with deployed content.\n \n \n+<h3 id=corb>CORB</h3>\n+\n+<p class=\"note\">Cross-origin read blocking, better known as CORB, is an algorithm by which dubious\n+cross-origin resource fetches are identified and blocked  before they reach a web page. CORB reduces\n+the risk of leaking sensitive data by keeping it further from cross-origin web pages.\n+\n+<p>A <dfn>CORB-protected MIME type</dfn> is an <a>HTML MIME type</a>, a <a>JSON MIME type</a>, or an\n+<a>XML MIME type</a> excluding <code>image/svg+xml</code>.\n+\n+<p class=\"note no-backref\">Accessing cross-origin resources with <a>CORB-protected MIME types</a> is\n+managed by the <a>CORS protocol</a> (e.g., in case of <a><code>fetch()</code></a> or\n+{{XMLHttpRequest}}), not observable (e.g., in case of pings or CSP reports which ignore the\n+response), or would result in an error (e.g., when failing to decode an HTML document embedded in an\n+<code>img</code> tag as an image). This means that CORB can block <a>CORB-protected MIME types</a>\n+resources without being disruptive to web pages.\n+\n+<p>To perform a <dfn noexport>CORB check</dfn>, given a <var>request</var> and <var>response</var>,\n+run these steps:</p>\n+\n+<ol>\n+ <li><p>If <var>request</var>'s <a for=request>initiator</a> is \"<code>download</code>\", then return\n+ <b>allowed</b>.\n+ <!-- XXX If we recast downloading as navigation this step can be removed. -->","path":"fetch.bs","position":26,"original_position":26,"commit_id":"3011eefad35f76fbf80690e180c16620a4968f72","original_commit_id":"3011eefad35f76fbf80690e180c16620a4968f72","user":{"login":"jakearchibald","id":93594,"avatar_url":"https://avatars1.githubusercontent.com/u/93594?v=4","gravatar_id":"","url":"https://api.github.com/users/jakearchibald","html_url":"https://github.com/jakearchibald","followers_url":"https://api.github.com/users/jakearchibald/followers","following_url":"https://api.github.com/users/jakearchibald/following{/other_user}","gists_url":"https://api.github.com/users/jakearchibald/gists{/gist_id}","starred_url":"https://api.github.com/users/jakearchibald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jakearchibald/subscriptions","organizations_url":"https://api.github.com/users/jakearchibald/orgs","repos_url":"https://api.github.com/users/jakearchibald/repos","events_url":"https://api.github.com/users/jakearchibald/events{/privacy}","received_events_url":"https://api.github.com/users/jakearchibald/received_events","type":"User","site_admin":false},"body":"@annevk what's your feeling on making this page-visible? I've been frustrated in the past digging into a spec detail only to find there was useful information in an html comment.","created_at":"2018-05-07T15:10:33Z","updated_at":"2018-05-07T15:26:19Z","html_url":"https://github.com/whatwg/fetch/pull/686#discussion_r186453421","pull_request_url":"https://api.github.com/repos/whatwg/fetch/pulls/686","author_association":"COLLABORATOR","_links":{"self":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/comments/186453421"},"html":{"href":"https://github.com/whatwg/fetch/pull/686#discussion_r186453421"},"pull_request":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/686"}}},"pull_request":{"url":"https://api.github.com/repos/whatwg/fetch/pulls/686","id":177858398,"html_url":"https://github.com/whatwg/fetch/pull/686","diff_url":"https://github.com/whatwg/fetch/pull/686.diff","patch_url":"https://github.com/whatwg/fetch/pull/686.patch","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/686","number":686,"state":"open","locked":false,"title":"CORB: blocking of nosniff and 206 responses","user":{"login":"anforowicz","id":12191912,"avatar_url":"https://avatars3.githubusercontent.com/u/12191912?v=4","gravatar_id":"","url":"https://api.github.com/users/anforowicz","html_url":"https://github.com/anforowicz","followers_url":"https://api.github.com/users/anforowicz/followers","following_url":"https://api.github.com/users/anforowicz/following{/other_user}","gists_url":"https://api.github.com/users/anforowicz/gists{/gist_id}","starred_url":"https://api.github.com/users/anforowicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anforowicz/subscriptions","organizations_url":"https://api.github.com/users/anforowicz/orgs","repos_url":"https://api.github.com/users/anforowicz/repos","events_url":"https://api.github.com/users/anforowicz/events{/privacy}","received_events_url":"https://api.github.com/users/anforowicz/received_events","type":"User","site_admin":false},"body":"# Motivation for the changes\n\nAllowing blocking of HTML/JSON/XML [nosniff](https://fetch.spec.whatwg.org/#should-response-to-request-be-blocked-due-to-nosniff?) responses going to image (or audio/video/font/track) destinations covers most of scenarios where [CORB](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md) is actually [observable in the wild today](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md#Quantifying-CORB-impact-on-existing-websites).\n\n# Explaining why blocking via net error is okay\n\nNote that 1) CORB explainer asks to block a protected response by injecting an empty body (see the \"[How does CORB “block” a response?](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md#How-does-CORB-block-a-response)\" section in the explainer) and 2) the Fetch spec asks to block a nosniff responses by injecting a network error (see the \"[Main fetch](https://fetch.spec.whatwg.org/#main-fetch)\" section, item 10). \n\nThis difference might matter for some destinations (e.g. XHR and `fetch()`), but shouldn't matter for destinations covered here.  For example - [HTMLImageElement](https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement)' `onerror` event will fire _both_ in case of a network error _and_ in case of a decode error (e.g. one triggered by the empty body injected by CORB).\n\nOne potential difference is the timing of when the network error VS decode error is observed.  In practice, this timing difference shouldn't matter though - CORB can be seen as a very slow network proxy that postpones the network error until the image decoding actually happens.\n\n\n<!--\n    This comment and the below content is programatically generated.\n    You may add a comma-separated list of anchors you'd like a\n    direct link to below (e.g. #idl-serializers, #idl-sequence):\n\n    Don't remove this comment or modify anything below this line.\n    If you don't want a preview generated for this pull request,\n    just replace the whole of this comment's content by \"no preview\"\n    and remove what's below.\n-->\n***\n<a href=\"https://whatpr.org/fetch/686.html\" title=\"Last updated on May 4, 2018, 10:37 PM GMT (3011eef)\">Preview</a> | <a href=\"https://whatpr.org/fetch/686/5b7dae0...3011eef.html\" title=\"Last updated on May 4, 2018, 10:37 PM GMT (3011eef)\">Diff</a>","created_at":"2018-03-27T20:38:13Z","updated_at":"2018-05-07T15:26:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c91704493518b44e5aaef7c4a15e26e52c28a237","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":520364549,"url":"https://api.github.com/repos/whatwg/fetch/labels/needs%20tests","name":"needs tests","color":"b60205","default":false},{"id":412528373,"url":"https://api.github.com/repos/whatwg/fetch/labels/security/privacy","name":"security/privacy","color":"0052cc","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/whatwg/fetch/pulls/686/commits","review_comments_url":"https://api.github.com/repos/whatwg/fetch/pulls/686/comments","review_comment_url":"https://api.github.com/repos/whatwg/fetch/pulls/comments{/number}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/686/comments","statuses_url":"https://api.github.com/repos/whatwg/fetch/statuses/3011eefad35f76fbf80690e180c16620a4968f72","head":{"label":"anforowicz:nosniff","ref":"nosniff","sha":"3011eefad35f76fbf80690e180c16620a4968f72","user":{"login":"anforowicz","id":12191912,"avatar_url":"https://avatars3.githubusercontent.com/u/12191912?v=4","gravatar_id":"","url":"https://api.github.com/users/anforowicz","html_url":"https://github.com/anforowicz","followers_url":"https://api.github.com/users/anforowicz/followers","following_url":"https://api.github.com/users/anforowicz/following{/other_user}","gists_url":"https://api.github.com/users/anforowicz/gists{/gist_id}","starred_url":"https://api.github.com/users/anforowicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anforowicz/subscriptions","organizations_url":"https://api.github.com/users/anforowicz/orgs","repos_url":"https://api.github.com/users/anforowicz/repos","events_url":"https://api.github.com/users/anforowicz/events{/privacy}","received_events_url":"https://api.github.com/users/anforowicz/received_events","type":"User","site_admin":false},"repo":{"id":126228411,"name":"fetch","full_name":"anforowicz/fetch","owner":{"login":"anforowicz","id":12191912,"avatar_url":"https://avatars3.githubusercontent.com/u/12191912?v=4","gravatar_id":"","url":"https://api.github.com/users/anforowicz","html_url":"https://github.com/anforowicz","followers_url":"https://api.github.com/users/anforowicz/followers","following_url":"https://api.github.com/users/anforowicz/following{/other_user}","gists_url":"https://api.github.com/users/anforowicz/gists{/gist_id}","starred_url":"https://api.github.com/users/anforowicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anforowicz/subscriptions","organizations_url":"https://api.github.com/users/anforowicz/orgs","repos_url":"https://api.github.com/users/anforowicz/repos","events_url":"https://api.github.com/users/anforowicz/events{/privacy}","received_events_url":"https://api.github.com/users/anforowicz/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/anforowicz/fetch","description":"Fetch Standard","fork":true,"url":"https://api.github.com/repos/anforowicz/fetch","forks_url":"https://api.github.com/repos/anforowicz/fetch/forks","keys_url":"https://api.github.com/repos/anforowicz/fetch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/anforowicz/fetch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/anforowicz/fetch/teams","hooks_url":"https://api.github.com/repos/anforowicz/fetch/hooks","issue_events_url":"https://api.github.com/repos/anforowicz/fetch/issues/events{/number}","events_url":"https://api.github.com/repos/anforowicz/fetch/events","assignees_url":"https://api.github.com/repos/anforowicz/fetch/assignees{/user}","branches_url":"https://api.github.com/repos/anforowicz/fetch/branches{/branch}","tags_url":"https://api.github.com/repos/anforowicz/fetch/tags","blobs_url":"https://api.github.com/repos/anforowicz/fetch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/anforowicz/fetch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/anforowicz/fetch/git/refs{/sha}","trees_url":"https://api.github.com/repos/anforowicz/fetch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/anforowicz/fetch/statuses/{sha}","languages_url":"https://api.github.com/repos/anforowicz/fetch/languages","stargazers_url":"https://api.github.com/repos/anforowicz/fetch/stargazers","contributors_url":"https://api.github.com/repos/anforowicz/fetch/contributors","subscribers_url":"https://api.github.com/repos/anforowicz/fetch/subscribers","subscription_url":"https://api.github.com/repos/anforowicz/fetch/subscription","commits_url":"https://api.github.com/repos/anforowicz/fetch/commits{/sha}","git_commits_url":"https://api.github.com/repos/anforowicz/fetch/git/commits{/sha}","comments_url":"https://api.github.com/repos/anforowicz/fetch/comments{/number}","issue_comment_url":"https://api.github.com/repos/anforowicz/fetch/issues/comments{/number}","contents_url":"https://api.github.com/repos/anforowicz/fetch/contents/{+path}","compare_url":"https://api.github.com/repos/anforowicz/fetch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/anforowicz/fetch/merges","archive_url":"https://api.github.com/repos/anforowicz/fetch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/anforowicz/fetch/downloads","issues_url":"https://api.github.com/repos/anforowicz/fetch/issues{/number}","pulls_url":"https://api.github.com/repos/anforowicz/fetch/pulls{/number}","milestones_url":"https://api.github.com/repos/anforowicz/fetch/milestones{/number}","notifications_url":"https://api.github.com/repos/anforowicz/fetch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/anforowicz/fetch/labels{/name}","releases_url":"https://api.github.com/repos/anforowicz/fetch/releases{/id}","deployments_url":"https://api.github.com/repos/anforowicz/fetch/deployments","created_at":"2018-03-21T19:11:41Z","updated_at":"2018-03-21T19:11:43Z","pushed_at":"2018-05-04T22:37:13Z","git_url":"git://github.com/anforowicz/fetch.git","ssh_url":"git@github.com:anforowicz/fetch.git","clone_url":"https://github.com/anforowicz/fetch.git","svn_url":"https://github.com/anforowicz/fetch","homepage":"https://fetch.spec.whatwg.org/","size":6580,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"cc-by-4.0","name":"Creative Commons Attribution 4.0","spdx_id":"CC-BY-4.0","url":"https://api.github.com/licenses/cc-by-4.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"whatwg:master","ref":"master","sha":"5b7dae0fcc24cc8e025b216b80248d2619177ac4","user":{"login":"whatwg","id":2226336,"avatar_url":"https://avatars1.githubusercontent.com/u/2226336?v=4","gravatar_id":"","url":"https://api.github.com/users/whatwg","html_url":"https://github.com/whatwg","followers_url":"https://api.github.com/users/whatwg/followers","following_url":"https://api.github.com/users/whatwg/following{/other_user}","gists_url":"https://api.github.com/users/whatwg/gists{/gist_id}","starred_url":"https://api.github.com/users/whatwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whatwg/subscriptions","organizations_url":"https://api.github.com/users/whatwg/orgs","repos_url":"https://api.github.com/users/whatwg/repos","events_url":"https://api.github.com/users/whatwg/events{/privacy}","received_events_url":"https://api.github.com/users/whatwg/received_events","type":"Organization","site_admin":false},"repo":{"id":5777189,"name":"fetch","full_name":"whatwg/fetch","owner":{"login":"whatwg","id":2226336,"avatar_url":"https://avatars1.githubusercontent.com/u/2226336?v=4","gravatar_id":"","url":"https://api.github.com/users/whatwg","html_url":"https://github.com/whatwg","followers_url":"https://api.github.com/users/whatwg/followers","following_url":"https://api.github.com/users/whatwg/following{/other_user}","gists_url":"https://api.github.com/users/whatwg/gists{/gist_id}","starred_url":"https://api.github.com/users/whatwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whatwg/subscriptions","organizations_url":"https://api.github.com/users/whatwg/orgs","repos_url":"https://api.github.com/users/whatwg/repos","events_url":"https://api.github.com/users/whatwg/events{/privacy}","received_events_url":"https://api.github.com/users/whatwg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/whatwg/fetch","description":"Fetch Standard","fork":false,"url":"https://api.github.com/repos/whatwg/fetch","forks_url":"https://api.github.com/repos/whatwg/fetch/forks","keys_url":"https://api.github.com/repos/whatwg/fetch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/whatwg/fetch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/whatwg/fetch/teams","hooks_url":"https://api.github.com/repos/whatwg/fetch/hooks","issue_events_url":"https://api.github.com/repos/whatwg/fetch/issues/events{/number}","events_url":"https://api.github.com/repos/whatwg/fetch/events","assignees_url":"https://api.github.com/repos/whatwg/fetch/assignees{/user}","branches_url":"https://api.github.com/repos/whatwg/fetch/branches{/branch}","tags_url":"https://api.github.com/repos/whatwg/fetch/tags","blobs_url":"https://api.github.com/repos/whatwg/fetch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/whatwg/fetch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/whatwg/fetch/git/refs{/sha}","trees_url":"https://api.github.com/repos/whatwg/fetch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/whatwg/fetch/statuses/{sha}","languages_url":"https://api.github.com/repos/whatwg/fetch/languages","stargazers_url":"https://api.github.com/repos/whatwg/fetch/stargazers","contributors_url":"https://api.github.com/repos/whatwg/fetch/contributors","subscribers_url":"https://api.github.com/repos/whatwg/fetch/subscribers","subscription_url":"https://api.github.com/repos/whatwg/fetch/subscription","commits_url":"https://api.github.com/repos/whatwg/fetch/commits{/sha}","git_commits_url":"https://api.github.com/repos/whatwg/fetch/git/commits{/sha}","comments_url":"https://api.github.com/repos/whatwg/fetch/comments{/number}","issue_comment_url":"https://api.github.com/repos/whatwg/fetch/issues/comments{/number}","contents_url":"https://api.github.com/repos/whatwg/fetch/contents/{+path}","compare_url":"https://api.github.com/repos/whatwg/fetch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/whatwg/fetch/merges","archive_url":"https://api.github.com/repos/whatwg/fetch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/whatwg/fetch/downloads","issues_url":"https://api.github.com/repos/whatwg/fetch/issues{/number}","pulls_url":"https://api.github.com/repos/whatwg/fetch/pulls{/number}","milestones_url":"https://api.github.com/repos/whatwg/fetch/milestones{/number}","notifications_url":"https://api.github.com/repos/whatwg/fetch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/whatwg/fetch/labels{/name}","releases_url":"https://api.github.com/repos/whatwg/fetch/releases{/id}","deployments_url":"https://api.github.com/repos/whatwg/fetch/deployments","created_at":"2012-09-12T08:39:20Z","updated_at":"2018-05-07T12:10:13Z","pushed_at":"2018-05-04T22:37:15Z","git_url":"git://github.com/whatwg/fetch.git","ssh_url":"git@github.com:whatwg/fetch.git","clone_url":"https://github.com/whatwg/fetch.git","svn_url":"https://github.com/whatwg/fetch","homepage":"https://fetch.spec.whatwg.org/","size":7198,"stargazers_count":955,"watchers_count":955,"language":"HTML","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":105,"mirror_url":null,"archived":false,"open_issues_count":127,"license":{"key":"cc-by-4.0","name":"Creative Commons Attribution 4.0","spdx_id":"CC-BY-4.0","url":"https://api.github.com/licenses/cc-by-4.0"},"forks":105,"open_issues":127,"watchers":955,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/686"},"html":{"href":"https://github.com/whatwg/fetch/pull/686"},"issue":{"href":"https://api.github.com/repos/whatwg/fetch/issues/686"},"comments":{"href":"https://api.github.com/repos/whatwg/fetch/issues/686/comments"},"review_comments":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/686/comments"},"review_comment":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/whatwg/fetch/pulls/686/commits"},"statuses":{"href":"https://api.github.com/repos/whatwg/fetch/statuses/3011eefad35f76fbf80690e180c16620a4968f72"}},"author_association":"NONE"}}
{"actor":{"display_login":"jakearchibald"}}