Timing-Allow-Origin: exposing detailed resource timings
Timing-Allow-Origin lets a named origin read detailed timing for a cross-origin resource, instead of the redacted values the Resource Timing API reports by default.
At a glance
- Direction
- Response only, set by the server that owns the resource.
- Defined in
- Resource Timing (W3C)
- When absent
- Timing attributes such as connection and response start are reported as zero, and transfer size is hidden.
- Value
- One or more origins, or the wildcard *
- Unlocks
- domainLookupStart, connectStart, responseStart, transferSize and the related attributes
- Not a substitute for
- Access-Control-Allow-Origin, which governs reading the body
- Typical setter
- Font, script and image hosts that want their customers to measure them
In detail
Detailed timings are withheld cross-origin for a reason: how long a resource took to fetch can reveal whether it was already cached, which leaks something about a visitor's history with another site. So the Resource Timing API zeroes most of the attributes for a resource from another origin unless that origin opts in with this header.
What you get back is the useful part of the measurement. Without the header a monitoring script can only see when the fetch started and when it finished; with it, the breakdown into name resolution, connection, request and response becomes visible, along with the transfer size, which is what tells you whether a resource was served from cache or over the network.
It is not a CORS header, and it grants nothing about reading the response body. A font or script host can send this while keeping its normal cross-origin rules unchanged, which is exactly why it exists as a separate header rather than as an extension of the CORS allow list.
If you run real user monitoring and your third party assets show zeroed timings, this is the header to ask their operator for. If you are the operator of a widely embedded asset, sending a wildcard is a small kindness that makes your resource measurable by everyone who depends on it.
Examples
HTTP/1.1 200 OK
Content-Type: font/woff2
Timing-Allow-Origin: *
Cache-Control: public, max-age=31536000, immutableTiming-Allow-Origin: https://app.example.comThings that catch people out
- Zeroed timings in a monitoring dashboard are usually this header missing on the third party resource, not a bug in the measurement code.
- It does not replace Access-Control-Allow-Origin. Adding it does nothing for a fetch that is being blocked from reading the body.
- Transfer size is one of the hidden attributes, so cache hit ratios for third party assets cannot be measured without it.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Access-Control-Allow-Origin: who may read this response
How the allow origin header is matched, why a wildcard fails with credentials, why it takes only one origin, and why Vary: Origin is mandatory when you echo.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Cross-Origin-Resource-Policy: who may embed this response
How CORP lets a response refuse to be embedded by other sites, how same-site differs from same-origin, and why asset hosts have to send cross-origin.
Referrer-Policy: controlling what the Referer header leaks
Every Referrer-Policy value compared, what modern browsers do when the header is missing, and why URLs with tokens in them leak to third parties without it.
Authorization: credentials on a request
How the Authorization header is structured, how Basic and Bearer differ, why it is dropped across a cross-host redirect, and how it interacts with caching.
WWW-Authenticate: the challenge that comes with a 401
What a 401 challenge must contain, what realm means to a browser, how Bearer error codes are reported, and why a 401 without this header is malformed.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL