← Back to release summary

Opaque Response Blocking (ORB, aka CORB++) v0.2

Category
Security
Type
No developer-visible change
Status
Enabled by default (Chrome 117)
Intent stage
None

Summary

Opaque Response Blocking (ORB) is a replacement for Cross-Origin Read Blocking (CORB - https://chromestatus.com/feature/5629709824032768). CORB and ORB are both heuristics that attempt to prevent cross-origin disclosure of “no-cors” subresources. This entry tracks "v0.2" of ORB - Chrome's second step toward full ORB implementation. ORB specifies error handling for blocked resources differently from CORB: ORB raises network errors, while CORB injects an empty response. ORB "v0.1" still used CORB-style response injection. This change brings our implementation more in line with the ORB proposal, by changing the error handling of all fetches (except when initiated by a script) to be compliant with ORB. We've made a carve-out for script-initiated fetches (where we retain CORB behaviour for now) to limit compatibility risk.

Standards & signals

Docs: https://github.com/whatwg/fetch/pull/1442

View on chromestatus.com