Remove CORB

[annevk]

It's not implemented as specified and only has one interested implementer.

• At least two implementers are interested (and none opposed):
  • …
  • …
• Tests are written and can be reviewed and commented upon at:
  • …
• Implementation bugs are filed:
  • Chrome: …
  • Firefox: …
  • Safari: …
  • Deno (not for CORS changes): …

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[annevk]

@anforowicz you probably know best what would need to happen here in terms of test changes. I was thinking I would create a PR for ORB on top of this so we'd have a clean slate.

[anforowicz]

I support removing CORB from the spec and WPT. I hope that existing CORB WPT coverage can be refactored to support/cover ORB instead:

1. Expecting blocked responses to hit a network error (instead of just having an empty response body). FWIW I've pinged https://crbug.com/827633 - one action item for Chrome might be to quantify the perceived risk of blocking-by-network-error VS blocking-by-injecting-empty-response-body (and if that risk is small, then Chrome should just switch to blocking-by-network-error).
2. Covering additional scenarios where CORB and ORB differ in their allow-vs-block decision. (It seems that most of the CORB-specific WPT testcases cover scenarios where ORB would behave in a similar way wrt allow-vs-block decision.)

[anforowicz]

Focusing on this specific PR:

• This PR LGTM.
• I wonder if before landing this PR, it might be worth putting together (and discussing/reviewing) a PR that adds ORB to the spec.

[annevk]

I suspect I'll have enough time tomorrow to put a draft ORB PR up. That will be based on the existing text. I'll also try to triage the ORB issues to figure out which need to be resolved for v0.

[annevk]

Okay, #1442 is now up for early review. It also gives a basic outline of the issues we still need to resolve.

[annevk]

I plan to land this one week from now. Please chime in if you have concerns.