PerformanceResourceTiming.secureConnectionStart

The secureConnectionStart read-only property returns a timestamp immediately before the browser starts the handshake process to secure the current connection. If a secure connection is not used, the property returns zero.

Value

The secureConnectionStart property can have the following values:

  • A DOMHighResTimeStamp indicating the time immediately before the browser starts the handshake process to secure the current connection if the resource is fetched over a secure connection.
  • 0 if no secure connection is used.
  • 0 if the resource was instantaneously retrieved from a cache.
  • 0 if the resource is a cross-origin request and no Timing-Allow-Origin HTTP response header is used.

Examples

Measuring SSL negotiation time

The secureConnectionStart and requestStart properties can be used to measure how long it takes for the SSL negotiation to happen.

const ssl = entry.requestStart - entry.secureConnectionStart;

Using a PerformanceObserver:

const observer = new PerformanceObserver((list) => {
  list.getEntries().forEach((entry) => {
    const ssl = entry.requestStart - entry.secureConnectionStart;
    if (ssl > 0) {
      console.log(`${entry.name}: SSL negotiation duration: ${ssl}ms`);
    }
  });
});

observer.observe({ type: "resource", buffered: true });

Or using Performance.getEntriesByType(), which only shows resource performance entries present in the browser's performance timeline at the time you call this method:

const resources = performance.getEntriesByType("resource");
resources.forEach((entry) => {
  const ssl = entry.requestStart - entry.secureConnectionStart;
  if (ssl > 0) {
    console.log(`${entry.name}: SSL negotiation duration: ${ssl}ms`);
  }
});

Cross-origin timing information

If the value of the secureConnectionStart property is 0, the resource is either not using a secure connection or it is a cross-origin request. To allow seeing cross-origin timing information, the Timing-Allow-Origin HTTP response header needs to be set.

For example, to allow https://developer.mozilla.org to see timing resources, the cross-origin resource should send:

Timing-Allow-Origin: https://developer.mozilla.org

Specifications

Specification
Resource Timing
# dom-performanceresourcetiming-secureconnectionstart

Browser compatibility

BCD tables only load in the browser

See also