Only expose iframe body size for same-origin navigations without cross-origin redirects

[noamr]

These values are "CORS-protected" for subresources, however iframes (and etc) are never CORS-protected, so we only expose these values for same-origin iframes without cross-origin redirects.

Closes #1960

• At least two implementers are interested (and none opposed):
  • Chromium (already implemented, behind a flag)
  • Mozilla (already implemented)
  • WebKit (encoded/decoded Body size is same-origin already)
• Tests are written and can be reviewed and commented upon at:
  • Resource timing: Test encoded/decoded body size with cross-origin iframes web-platform-tests/wpt#63053
• Implementation bugs are filed:
  • Chromium: https://issues.chromium.org/issues/40251936 (to ship the flag)
  • Gecko: …
  • WebKit: …
• MDN issue is filed: Be more accurate about cross-origin protections mdn/content#23740 tracks this
• The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff