Intent to Ship: Cross-origin redirect timing opt-in

[Yoav Weiss (@Shopify)]

Contact emails

yoav...@chromium.org

Explainer

Navigation-Timing and cross-origin redirects currently have issues related to both interoperability and missing functionality.

`redirectCount`, `redirectStart` and `redirectEnd` are not currently exposed in Chromium for navigation responses where the redirect chain included cross-origin redirects. This is different from WebKit that exposes them when `Timing-Allow-Origin` is included in all responses in the chain.

This feature changes that behavior and exposes these attributes when the Timing-Allow-Origin opt-in is either '*' or explicitly opts in to the destination navigation origin.

That would enable developers to optimize cross-origin redirects that are under their control, or report issues to 3P redirect providers, assuming those providers opt-in to such reporting, presumably due to to the non-sensitive nature of their redirects. 

Specification

https://github.com/whatwg/fetch/pull/1931

Summary

Currently developers have no way to measure cross-origin redirects for navigations, even ones under their control, or ones that choose to opt-in to be measured. This feature enables servers to opt-in to have their redirects measured by the destination origin of the navigation.

Blink component

Blink>PerformanceAPIs>NavigationTiming

Web Feature ID

Missing feature

This behavior change seems relatively minor so I have filed for a feature ID. Let me know if you disagree.

Motivation

Enables developers to measure and optimize their cross-origin redirects, while ensuring that opt-in are secure and aligned with the developer's intention.

Initial public proposal

https://github.com/w3c/navigation-timing/issues/215

TAG review

No TAG review as this is a minor behavior change for an existing feature. The change was discussed in the relevant WG.
Let me know if you think a TAG review is needed.

TAG review status

Not applicable

Goals for experimentation

None

Risks

Interoperability and Compatibility

No information provided

Gecko: No signal
It's unclear if this is significant enough for a position request. I pinged the relevant Mozilla folks.

WebKit: Positive (https://github.com/whatwg/fetch/pull/1931#pullrequestreview-4560631006)

No position filed as this is a minor behavior change. WebKit are explicitly supportive for WHATWG process purposes.

Web developers: Positive (https://w3c.github.io/web-performance/meetings/2026/2026-06-04/index.html) 

This was discussed at the WebPerfWG, and folks were supportive. Developers at Shopify are highly supportive of being able to measure and optimize redirects.

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

No information provided

Debuggability

No information provided

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, ChromeOS, Android, and Android WebView)?

Yes

Is this feature fully tested by web-platform-tests?

Yes
https://github.com/web-platform-tests/wpt/pull/60823

Flag name on about://flags

No information provided

Finch feature name

NavigationTimingRedirectTimingViaTAO

Rollout plan

Will ship enabled for all users

Requires code in //chrome?

False

Tracking bug

https://issues.chromium.org/issues/521861828

Estimated milestones

Shipping on desktop	151
Shipping on Android	151
Shipping on WebView	151

Anticipated spec changes

Open questions about a feature may be a source of future web compat or interop issues. Please list open issues (e.g. links to known github issues in the project for the feature specification) whose resolution may introduce web compat/interop risk (e.g., changing to naming or structure of the API in a non-backward-compatible way).

No information provided

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5078310347472896?gate=6080757828288512

Links to previous Intent discussions

Intent to Prototype: https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAOmohS%2BmvvuuG%3D0Jww9xDpDZVsgn90p-VHUjX-exx2SnU8Zf%3Dg%40mail.gmail.com

This intent message was generated by Chrome Platform Status.

[Yoav Weiss (@Shopify)]

Mozilla seem positive: https://github.com/whatwg/fetch/pull/1931#issuecomment-4789157542 

[Alex Russell]

LGTM1; this is a great change.

[Yoav Weiss (@Shopify)]

On Wednesday, June 24, 2026 at 2:30:12 PM UTC+3 Yoav Weiss wrote:

Contact emails

yoav...@chromium.org

Explainer

Navigation-Timing and cross-origin redirects currently have issues related to both interoperability and missing functionality.

`redirectCount`, `redirectStart` and `redirectEnd` are not currently exposed in Chromium for navigation responses where the redirect chain included cross-origin redirects. This is different from WebKit that exposes them when `Timing-Allow-Origin` is included in all responses in the chain.

This feature changes that behavior and exposes these attributes when the Timing-Allow-Origin opt-in is either '*' or explicitly opts in to the destination navigation origin.

That would enable developers to optimize cross-origin redirects that are under their control, or report issues to 3P redirect providers, assuming those providers opt-in to such reporting, presumably due to to the non-sensitive nature of their redirects. 

Specification

https://github.com/whatwg/fetch/pull/1931

The relevant Fetch and HTML PRs have now landed.

 

Shipping on desktop151Shipping on Android151Shipping on WebView151

[Chris Harrelson]

LGTM2

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/80de699f-1536-418b-b247-70e26d49ea1en%40chromium.org.

[Mike Taylor]

LGTM3

To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAOMQ%2Bw8sO7BwrPARV%3Dh0hSrXg9DFDQUjy6jrd3qhW56fX8%2BN4g%40mail.gmail.com.