Post

Browsers are VERY careful about cross-origin leaks. They can cause all sorts of security issues. In generally, one origin on the web, should not be allowed to know anything about what’s going on from another origin—even if it’s embedding content from that origin on its own page!

It doesn’t take much to come up with scenarios as to how this could be abused. For example if I include an image from another site that is only available to logged in users, then I can easily figure out whether a user is logged in to that site or not.

So web APIs are often deliberately limited to reduce any risks with this by exposing less data than they get for same-origin resources. One of those things is the LCP presentation time (when the pixels are drawn to screen and so viewable by the user). We didn’t want to expose this unconditionally.

Barry, it's Sunday.

Barry has tuned the web so much he now has more than 7 days a week

Maybe I should tune the "get a life" knob up a little from zero?

I’ve written a long question (on something else) for Barry but decided I’d wait until tomorrow so he could at least have some life on a Sunday - looks like I could have posted it anyway!

I’ve a date soon with a bear, marmalade sandwiches, a jungle in deepest, darkest Peru, and three children neglected by me for the last week. Plus also to give one amazing mum/wife a much needed break from said children. So I won’t be answering any questions for a bit!

To be fair, I feel like airports can be excluded from the weekend rule. They exist outside of time and space. I'm their own dimension, if you will

😄 but also great to know. Thanks for sharing. I didn't know this but maybe because most external domain lcp images I've come across are on image cdn services