Timing-Allow-Origin header
Baseline
Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since January 2020.
The HTTP Timing-Allow-Origin response header specifies origins that are allowed to see values of attributes retrieved via features of the Resource Timing API that are otherwise restricted for cross-origin resources.
Without it, the browser reports these values as zero, an empty string, or an empty array.
For the list of affected properties, see Cross-origin restrictions in the PerformanceResourceTiming reference.
The browser checks this header on cross-origin responses: same-origin resources expose full timing information without it.
This header is independent of CORS.
Passing the CORS check doesn't grant access to detailed timing information.
Conversely, Timing-Allow-Origin doesn't expose properties that describe the response itself, such as its body size, content type, or status code.
| Header type | Response header |
|---|
Syntax
Timing-Allow-Origin: *
Timing-Allow-Origin: <origin>, …, <originN>
Directives
*(wildcard)-
Any origin may see timing resources.
<origin>-
Specifies a URI that may see the timing resources. You can specify multiple origins, separated by commas.
Examples
Using Timing-Allow-Origin
To allow any resource to see timing resources:
Timing-Allow-Origin: *
To allow https://developer.mozilla.org to see timing resources, you can specify:
Timing-Allow-Origin: https://developer.mozilla.org
Specifications
| Specification |
|---|
| Resource Timing # sec-timing-allow-origin |
Browser compatibility
See also
PerformanceResourceTiming- Resource Timing API
Server-TimingheaderVaryheader