diff --git a/files/en-us/web/api/performance/measureuseragentspecificmemory/index.md b/files/en-us/web/api/performance/measureuseragentspecificmemory/index.md index f7591dd5e81e2df..5e804d638c8442e 100644 --- a/files/en-us/web/api/performance/measureuseragentspecificmemory/index.md +++ b/files/en-us/web/api/performance/measureuseragentspecificmemory/index.md @@ -12,14 +12,6 @@ browser-compat: api.Performance.measureUserAgentSpecificMemory The **`measureUserAgentSpecificMemory()`** method is used to estimate the memory usage of a web application including all its iframes and workers. -## Description - -The browser automatically allocates memory when objects are created and frees it when they are not reachable anymore (garbage collection). This garbage collection (GC) is an approximation since the general problem of determining whether or not a specific piece of memory is still needed is impossible (see also [JavaScript Memory Management](/en-US/docs/Web/JavaScript/Memory_management)). Developers need to make sure that objects are garbage collected, memory isn't leaked, and memory usage doesn't grow unnecessarily over time leading to slow and unresponsive web applications. Memory leaks are typically introduced by forgetting to unregister an event listener, not closing a worker, accumulating objects in arrays, and more. - -The `measureUserAgentSpecificMemory()` API aggregates memory usage data to help you find memory leaks. It can be used for memory regression detection or for A/B testing features to evaluate their memory impact. Rather than make single calls to this method, it's better to make periodic calls to track how memory usage changes over the duration of a session. - -The `byte` values this API returns aren't comparable across browsers or between different versions of the same browser as these are highly implementation dependent. Also, how `breakdown` and `attribution` arrays are provided is up to the browser as well. It is best to not hardcode any assumptions about this data. This API is rather meant to be called periodically (with a randomized interval) to aggregate data and analyze the difference between the samples. - ## Syntax ```js-nolint @@ -97,23 +89,21 @@ An example return value looks like this: ### Exceptions - `SecurityError` {{domxref("DOMException")}} - - : Thrown if the security requirements for preventing cross-origin information leaks aren't fulfilled. + - : Thrown if the [security requirements](#security_requirements) for preventing cross-origin information leaks aren't fulfilled. -## Security requirements +## Description + +The browser automatically allocates memory when objects are created and frees it when they are not reachable anymore (garbage collection). This garbage collection (GC) is an approximation since the general problem of determining whether or not a specific piece of memory is still needed is impossible (see also [JavaScript Memory Management](/en-US/docs/Web/JavaScript/Memory_management)). Developers need to make sure that objects are garbage collected, memory isn't leaked, and memory usage doesn't grow unnecessarily over time leading to slow and unresponsive web applications. Memory leaks are typically introduced by forgetting to unregister an event listener, not closing a worker, accumulating objects in arrays, and more. -Your site needs to be in a [secure context](/en-US/docs/Web/Security/Secure_Contexts). +The `measureUserAgentSpecificMemory()` API aggregates memory usage data to help you find memory leaks. It can be used for memory regression detection or for A/B testing features to evaluate their memory impact. Rather than make single calls to this method, it's better to make periodic calls to track how memory usage changes over the duration of a session. -Two headers need to be set to cross-origin isolate your site: +The `byte` values this API returns aren't comparable across browsers or between different versions of the same browser as these are highly implementation dependent. Also, how `breakdown` and `attribution` arrays are provided is up to the browser as well. It is best to not hardcode any assumptions about this data. This API is rather meant to be called periodically (with a randomized interval) to aggregate data and analyze the difference between the samples. -- [`Cross-Origin-Opener-Policy`](/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy) with `same-origin` as value (protects your origin from attackers) -- [`Cross-Origin-Embedder-Policy`](/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy) with `require-corp` or `credentialless` as value (protects victims from your origin) +## Security requirements -```http -Cross-Origin-Opener-Policy: same-origin -Cross-Origin-Embedder-Policy: require-corp -``` +To use this method your document must be in a [secure context](/en-US/docs/Web/Security/Secure_Contexts) and {{domxref("Window.crossOriginIsolated","cross-origin isolated","","nocode")}}. -To check if cross origin isolation has been successful, you can test against the {{domxref("Window.crossOriginIsolated")}} property or the {{domxref("WorkerGlobalScope.crossOriginIsolated")}} property available to window and worker contexts: +You can use the {{domxref("Window.crossOriginIsolated")}} and {{domxref("WorkerGlobalScope.crossOriginIsolated")}} properties to check if the document is cross-origin isolated: ```js if (crossOriginIsolated) { diff --git a/files/en-us/web/api/performance/now/index.md b/files/en-us/web/api/performance/now/index.md index 7e476caf6fe3d31..cbd26c6b2fee3b7 100644 --- a/files/en-us/web/api/performance/now/index.md +++ b/files/en-us/web/api/performance/now/index.md @@ -62,6 +62,21 @@ The specification (Level 2) requires that `performance.now()` should tick during More details can also be found in the specification issue [hr-time#115](https://github.com/w3c/hr-time/issues/115#issuecomment-1172985601). +## Security requirements + +To offer protection against timing attacks and [fingerprinting](/en-US/docs/Glossary/Fingerprinting), `performance.now()` is coarsened based on whether or not the document is {{domxref("Window.crossOriginIsolated","cross-origin isolated","","nocode")}}. + +- Resolution in isolated contexts: 5 microseconds +- Resolution in non-isolated contexts: 100 microseconds + +You can use the {{domxref("Window.crossOriginIsolated")}} and {{domxref("WorkerGlobalScope.crossOriginIsolated")}} properties to check if the document is cross-origin isolated: + +```js +if (crossOriginIsolated) { + // Use measureUserAgentSpecificMemory +} +``` + ## Examples ### Using `performance.now()` @@ -75,26 +90,6 @@ const t1 = performance.now(); console.log(`Call to doSomething took ${t1 - t0} milliseconds.`); ``` -## Security requirements - -To offer protection against timing attacks and [fingerprinting](/en-US/docs/Glossary/Fingerprinting), `performance.now()` is coarsened based on site isolation status. - -- Resolution in isolated contexts: 5 microseconds -- Resolution in non-isolated contexts: 100 microseconds - -Cross-origin isolate your site using the {{HTTPHeader("Cross-Origin-Opener-Policy")}} and -{{HTTPHeader("Cross-Origin-Embedder-Policy")}} headers: - -```http -Cross-Origin-Opener-Policy: same-origin -Cross-Origin-Embedder-Policy: require-corp -``` - -These headers ensure a top-level document does not share a browsing context group with -cross-origin documents. COOP process-isolates your document and potential attackers -can't access to your global object if they were opening it in a popup, preventing a set -of cross-origin attacks dubbed [XS-Leaks](https://github.com/xsleaks/xsleaks). - ## Specifications {{Specifications}} diff --git a/files/en-us/web/api/window/crossoriginisolated/index.md b/files/en-us/web/api/window/crossoriginisolated/index.md index 4c3d298e2fa89b1..f0a84a351dcaa88 100644 --- a/files/en-us/web/api/window/crossoriginisolated/index.md +++ b/files/en-us/web/api/window/crossoriginisolated/index.md @@ -10,7 +10,7 @@ browser-compat: api.crossOriginIsolated The **`crossOriginIsolated`** read-only property of the {{domxref("Window")}} interface returns a boolean value that indicates whether the document is cross-origin isolated. -A cross-origin isolated document only shares its {{glossary("Browsing context","browsing context group")}} with same-origin documents in popups and navigations, and resources (both same-origin and cross-origin) that the document has opted into using via [CORS](/en-US/docs/Web/HTTP/CORS) (and [COEP](/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy) for `