WPT details: Test coverage exists at wpt/fetch/corb. Note that these tests work well as ORB v0.1 coverage, but might need significant changes for covering the full ORB algorithm: *) ORB v0.1 blocks less responses than full ORB *) ORB v0.1 blocks responses by stripping HTTP response headers and injecting an empty HTTP response body (just like CORB), unlike the full ORB which is planned to result in a network error (once integrated into the full Fetch spec).
Opaque Response Blocking (ORB) is a replacement for Cross-Origin Read Blocking (CORB - https://chromestatus.com/feature/5629709824032768). CORB and ORB are both heuristics that attempt to prevent cross-origin disclosure of “no-cors” subresources. This entry tracks v0.1 of ORB - Chrome's first step toward full ORB implementation. For interop web authors should check Content-Type headers of their resources and indicate multimedia content when needed (e.g. audio/*, application/dash+xml, etc).
ORBv0.1 is an incremental step toward full ORB compliance (i.e. a step toward cross-browser compatibility). ORBv0.1 offers incremental security benefits compared to CORB. ORB v0.1 still fails open like CORB and unlike full ORB, but protects more responses: *) CORB blocks responses that contain HTML and XML only if they are labeled with HTML mime type or XML mime type. ORBv0.1 blocks responses that contain HTML and XML even if they are mislabeled (e.g. HTML served as application/octet-stream, or XML served as text/html). *) CORB blocks range request responses only if they are labeled with HTML, JSON, or XML mime type. ORBv0.1 blocks all range request responses, unless they come from a URL that ORBv0.1 has earlier recognized (via sniffing, or via mime type) as audio or video.