Add TAO destination check for navigation redirect chains by yoavweiss · Pull Request #1931 · whatwg/fetch

yoavweiss · 2026-06-05T08:26:53Z

As part of the WebPerfWG discussion on re-exposing redirectCount for opted-in cross-origin redirects, we discussed the fact that TAO currently only opts-in "backwards" in terms of origins, and doesn't constitute an opt-in to the destination origin, which is the appropriate opt-in for navigations (contrary to subresources).

This PR adds the mechanisms that can enable such "forward" opt-in, and can enable a response to a redirect chain to know that the redirect chain opted in to expose the redirects to its origin.

Once this lands, we'd use the relevant algorithms in the related HTML PR.

At least two implementers are interested (and none opposed):
- Chromium: Add TAO destination check for navigation redirect chains #1931 (comment)
- WebKit: Add TAO destination check for navigation redirect chains #1931 (review)
Tests are written and can be reviewed and commented upon at:
- Navigation-Timing: destination-based TAO web-platform-tests/wpt#60823
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/521861828
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=2049166
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=316647
- Deno (not for CORS changes): N/A as it doesn't do navigations.
MDN issue is filed: Navigation Timing - Timing-Allow-Origin change mdn/mdn#841
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

noamr · 2026-06-09T13:55:16Z

Chrome team is supportive.

noamr

Wouldn't it be simpler to keep a list of TAO value sets and iterate over them when computing the "navigation TAO check"?

yoavweiss · 2026-06-10T11:16:04Z

Wouldn't it be simpler to keep a list of TAO value sets and iterate over them when computing the "navigation TAO check"?

@annevk made a similar comment earlier on.

What we can do is something like:

We need the end response of the chain to have a list of lists of all the TAO values each response seen. We can get that by adding the a list of lists of past values to the redirect request and then move it to the response.
Navigation TAO check would verify that the TAO values of each response contain "*" or destination origin, otherwise it'd fail.

I don't know that it's simpler (and it seems like we'd be copying more values around between redirect responses), but happy to move to that model if that's simpler/easier

noamr · 2026-06-10T16:37:33Z

Wouldn't it be simpler to keep a list of TAO value sets and iterate over them when computing the "navigation TAO check"?

@annevk made a similar comment earlier on.

What we can do is something like:

We need the end response of the chain to have a list of lists of all the TAO values each response seen. We can get that by adding the a list of lists of past values to the redirect request and then move it to the response.

Navigation TAO check would verify that the TAO values of each response contain "*" or destination origin, otherwise it'd fail.

I don't know that it's simpler (and it seems like we'd be copying more values around between redirect responses), but happy to move to that model if that's simpler/easier

It's simpler to read (IMO) and potentially cleaner impl wise as there is no set manipulation as you go along and it's not a dedup check for each redirect.

noamr

LGTM (though needs the checkboxes etc)

yoavweiss · 2026-06-21T05:50:06Z

@annevk - Can you take a look? Do I need to file a WebKit position on this, or will you be able to state support here?

…stination origin. https://bugs.webkit.org/show_bug.cgi?id=316647 Reviewed by NOBODY (OOPS!). This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513, and ensures that TAO opt-ins for navigation timing take the destination origin into account. Tests: imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-destination.tentative.html imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-partial.tentative.html imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-destination.tentative.html imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-no-referrer.tentative.html imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-other-origin.tentative.html imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-wildcard.tentative.html * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-destination.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-destination.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-partial.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-chain-tao-partial.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-destination.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-destination.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-no-referrer.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-no-referrer.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-other-origin.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-other-origin.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-wildcard.tentative-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-xserver-tao-wildcard.tentative.html: Added. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/redirect-tao.py: Added. (main): * Source/WebCore/page/PerformanceNavigationTiming.cpp: (WebCore::PerformanceNavigationTiming::redirectCount const): * Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::checkRedirection): (WebKit::NetworkLoadChecker::validateResponse): (WebKit::NetworkLoadChecker::appendToNavigationTimingAllowCheckList): (WebKit::NetworkLoadChecker::passesNavigationTAOCheck const): (WebKit::NetworkLoadChecker::shouldExposeNavigationRedirectTiming): * Source/WebKit/NetworkProcess/NetworkLoadChecker.h:

This CL implements whatwg/html#12513 and whatwg/fetch#1931, in order to resolve w3c/navigation-timing#215. It enables developers to opt-in to get cross-origin redirect timings, through destination-based Timing-Allow-Origin headers. I2P: https://groups.google.com/a/chromium.org/g/blink-dev/c/GOPn8-wQlsk/m/x5Q3G6KuAgAJ Change-Id: Ib463010f1862af523a241d2e9180ff09bfedb101 Bug: 521861828 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7915892 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Noam Rosenthal <nrosenthal@google.com> Cr-Commit-Position: refs/heads/main@{#1650808}

annevk

This design seemed reasonable to @achristensen07 and I so you can consider WebKit supportive.

Bas-moz · 2026-06-24T12:12:49Z

This looks good from the Mozilla side as well.

This CL implements whatwg/html#12513 and whatwg/fetch#1931, in order to resolve w3c/navigation-timing#215. It enables developers to opt-in to get cross-origin redirect timings, through destination-based Timing-Allow-Origin headers. I2P: https://groups.google.com/a/chromium.org/g/blink-dev/c/GOPn8-wQlsk/m/x5Q3G6KuAgAJ Change-Id: Ib463010f1862af523a241d2e9180ff09bfedb101 Bug: 521861828 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7915892 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Noam Rosenthal <nrosenthal@google.com> Cr-Commit-Position: refs/heads/main@{#1650808} Co-authored-by: Yoav Weiss <yoavweiss@chromium.org>

…stination origin. https://bugs.webkit.org/show_bug.cgi?id=316647 Reviewed by NOBODY (OOPS!). This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513, and ensures that TAO opt-ins for navigation timing take the destination origin into account. * Source/WebCore/page/PerformanceNavigationTiming.cpp: (WebCore::PerformanceNavigationTiming::redirectCount const): * Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::checkRedirection): (WebKit::NetworkLoadChecker::validateResponse): (WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): (WebKit::NetworkLoadChecker::passesNavigationTAOCheck const): (WebKit::NetworkLoadChecker::shouldExposeNavigationRedirectTiming): * Source/WebKit/NetworkProcess/NetworkLoadChecker.h:

Fetch PR: whatwg/fetch#1931.

…stination origin. https://bugs.webkit.org/show_bug.cgi?id=316647 Reviewed by NOBODY (OOPS!). This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513, and ensures that TAO opt-ins for navigation timing take the destination origin into account. No new tests, but a test progresses. * LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt: Progression. * Source/WebCore/page/PerformanceNavigationTiming.cpp: (WebCore::PerformanceNavigationTiming::redirectCount const): TAO check. * Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::checkRedirection): Append TAO values. (WebKit::NetworkLoadChecker::validateResponse): Set TAO values on the response. (WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): Accumulate TAO values. (WebKit::NetworkLoadChecker::passesNavigationTAOCheck const): Check if the response passes TAO check. (WebKit::NetworkLoadChecker::shouldExposeNavigationRedirectTiming): helper method. * Source/WebKit/NetworkProcess/NetworkLoadChecker.h:

Add TAO destination check for navigation redirect chains

10f655d

yoavweiss marked this pull request as draft June 5, 2026 08:26

success/failure

165dcad

yoavweiss marked this pull request as ready for review June 5, 2026 08:41

yoavweiss requested a review from annevk June 5, 2026 08:50

yoavweiss added 2 commits June 5, 2026 11:28

Variable rename and simplification

4639486

Add notes and clarify

7aab34b

yoavweiss mentioned this pull request Jun 8, 2026

Expose redirectCount for TAO opted-in redirect chains whatwg/html#12513

Merged

6 tasks

yoavweiss requested a review from noamr June 9, 2026 07:09

yoavweiss added a commit to yoavweiss/html that referenced this pull request Jun 9, 2026

Move to use whatwg/fetch#1931

ea4485e

yoavweiss mentioned this pull request Jun 9, 2026

Navigation Timing: cross-origin redirect opt-in should be based on destination origin. WebKit/WebKit#66762

Open

noamr reviewed Jun 10, 2026

View reviewed changes

Change model to a list of lists

82bd34a

yoavweiss requested a review from noamr June 17, 2026 13:31

noamr approved these changes Jun 18, 2026

View reviewed changes

yoavweiss mentioned this pull request Jun 21, 2026

Navigation Timing - destination based TAO web-platform-tests/wpt#60775

Closed

chromium-wpt-export-bot mentioned this pull request Jun 23, 2026

Navigation-Timing: destination-based TAO web-platform-tests/wpt#60823

Merged

yoavweiss mentioned this pull request Jun 23, 2026

Navigation Timing - Timing-Allow-Origin change mdn/mdn#841

Open

annevk approved these changes Jun 24, 2026

View reviewed changes

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Comment thread fetch.bs Outdated

Review comments

48b86d4

yoavweiss mentioned this pull request Jun 24, 2026

Make NavTiming TAO redirect test non-tentative web-platform-tests/wpt#60873

Merged

annevk merged commit aa0bd92 into main Jun 25, 2026
2 checks passed

annevk deleted the navigation_tao_destination branch June 25, 2026 06:36

annevk pushed a commit to whatwg/html that referenced this pull request Jun 25, 2026

Expose redirectCount for TAO opted-in navigation redirect chains

b94ff88

Fetch PR: whatwg/fetch#1931.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add TAO destination check for navigation redirect chains#1931

Add TAO destination check for navigation redirect chains#1931
annevk merged 6 commits into
mainfrom
navigation_tao_destination

yoavweiss commented Jun 5, 2026 •

edited by pr-preview Bot

Loading

Uh oh!

noamr commented Jun 9, 2026

Uh oh!

noamr left a comment

Uh oh!

yoavweiss commented Jun 10, 2026

Uh oh!

noamr commented Jun 10, 2026

Uh oh!

noamr left a comment

Uh oh!

yoavweiss commented Jun 21, 2026

Uh oh!

annevk left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Bas-moz commented Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

yoavweiss commented Jun 5, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Jun 9, 2026

Uh oh!

noamr left a comment

Choose a reason for hiding this comment

Uh oh!

yoavweiss commented Jun 10, 2026

Uh oh!

noamr commented Jun 10, 2026

Uh oh!

noamr left a comment

Choose a reason for hiding this comment

Uh oh!

yoavweiss commented Jun 21, 2026

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Bas-moz commented Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

yoavweiss commented Jun 5, 2026 •

edited by pr-preview Bot

Loading