This. And even if the browser does block the request, the js probably sees that as an error code 0 (standard for cors) at which point it can use the performanc

This. And even if the browser does block the request, the js probably sees that as an error code 0 (standard for cors) at which point it can use the performance timing apis. Side channels are tough.