Security: Service implementors should consider timing-based information leakage attacks

If OData is used in a web application scenario, information about existence of OData endpoints may leak using time sidechannels. The attack scenario is as follows: an attacker forces a victim to load an OData resource in his browser (for example using an <img> or <iframe> tag) and times how long the loading takes. It is thus possible for the attack to observe whether an empty/401 response (small) or a 200 response with a certain payload size (“big”) was returned. Combined with the powerful OData syntax ($filter, contains() etc.), iterated requests may be used to leak information.