If the hash functions are secure, the only way for this to leak information is if the attacker can make good guesses as to what the resource is a priori, and th

If the hash functions are secure, the only way for this to leak information is if the attacker can make good guesses as to what the resource is a priori, and then use this to verify it. Fair enough, that's some information leakage, but it's certainly not easy to exploit. Normal cross-origin limitations still apply, so you'd need to get creative to even get the information in the first place, and if you can, it's not clear what this adds over a timing attack. I'm still a little skeptical such a heavy handed restriction is necessary to maintain the current level of security; but then again - why take the risk?