Stop Cross-Site Timing Attacks with SameSite cookies

1 · Ilya Grigorik · Aug. 26, 2016, 7 a.m.
Let's say we have a client that can initiate a network request for any URL on the web but the response is opaque and cannot be inspected. What could we learn about the client or the response? As it turns out, armed with a bit of patience and rudimentary statistics, "a lot". For example, the duration of the fetch is a combination of network time of the request reaching the server, server processing time, and network time of the response. Each and every one of these steps "leaks" information both...