@@ -27,7 +27,6 @@ urlPrefix: https://html.spec.whatwg.org/; spec: HTML;
27
27
text: x-frame-options; url: multipage/browsing-the-web.html#the-x-frame-options-header
28
28
urlPrefix: https://fetch.spec.whatwg.org/; spec: FETCH; type: dfn
29
29
text: cross-origin resource policy; url: #http-cross-origin-resource-policy
30
- text: cross-origin read blocking; url: #corb
31
30
urlPrefix: https://tc39.es/ecma262/; spec: ECMA262; type: interface
32
31
text: SharedArrayBuffer; url: #sec-sharedarraybuffer-objects
33
32
urlPrefix: https://tools.ietf.org/html/rfc7231; spec: RFC7231; type: http-header
@@ -141,6 +140,11 @@ urlPrefix: https://fetch.spec.whatwg.org/; spec: FETCH; type: http-header
141
140
"authors": [ "Artur Janc" ] ,
142
141
"date": "2020-12"
143
142
},
143
+ "corb": {
144
+ "href": "https://chromium.googlesource.com/chromium/src/+/HEAD/services/network/cross_origin_read_blocking_explainer.md",
145
+ "title": "Cross-Origin Read Blocking (CORB)",
146
+ "authors": [ "The Chromium Authors" ]
147
+ },
144
148
"orb": {
145
149
"href": "https://github.com/annevk/orb",
146
150
"title": "Opaque Response Blocking (ORB, aka CORB++)",
@@ -247,7 +251,7 @@ TL;DR {#tldr}
247
251
necessary.
248
252
249
253
5. **Prevent MIME-type confusion attacks** and increase the robustness of passive defenses like
250
- [= cross-origin read blocking=] ( CORB) /
254
+ <a href="https://chromium.googlesource.com/chromium/src/+/HEAD/services/network/cross_origin_read_blocking_explainer.md"> cross-origin read blocking</a> ( [[ CORB]] ) /
251
255
<a href="https://github.com/annevk/orb">opaque response blocking</a> ([[ORB]] ) by setting
252
256
correct `Content-Type` headers, and globally asserting `X-Content-Type-Options: nosniff`.
253
257
@@ -274,7 +278,7 @@ seem generally applicable:
274
278
275
279
2. Subresources should opt-out of MIME type sniffing by sending an
276
280
<a http-header>`X-Content-Type-Options`</a> header with a value of `nosniff`. This increases the
277
- robustness of MIME-based checks like [= cross-origin read blocking=] ( CORB) /
281
+ robustness of MIME-based checks like <a href="https://chromium.googlesource.com/chromium/src/+/HEAD/services/network/cross_origin_read_blocking_explainer.md"> cross-origin read blocking</a> ( [[ CORB]] ) /
278
282
<a href="https://github.com/annevk/orb">opaque response blocking</a> ([[ORB]] ), and mitigates
279
283
some well-known risks around type confusion for scripts.
280
284
0 commit comments