Timing-Allow-Origin

ResponseActive

Timing-Allow-Origin controls which origins can access detailed resource timing data for a response via the PerformanceResourceTiming API. Without this header, cross-origin resources only expose coarse timing. With Timing-Allow-Origin: *, any origin's JavaScript can see the full timing breakdown – DNS lookup, TCP connect, TLS handshake, TTFB, transfer.

Timing-Allow-Origin: * | <origin>[, <origin>]*

Description

The Resource Timing API gives JavaScript access to how long each network request took. For cross-origin resources, most timing fields are zeroed out unless the server opts in via Timing-Allow-Origin. CDNs serving shared assets often set Timing-Allow-Origin: * so that Real User Monitoring (RUM) scripts can measure CDN performance. Setting * exposes detailed timing to any page that loads the resource.

Examples

Allow all origins

http

Timing-Allow-Origin: *

Allow specific origin

http

Timing-Allow-Origin: https://app.example.com

Specification

W3C Resource Timing – Timing-Allow-Origin specification →