Timing-Allow-Origin header

The HTTP Timing-Allow-Origin {{Glossary("response header")}} specifies origins that are allowed to see values of attributes retrieved via features of the Resource Timing API that are otherwise restricted for cross-origin resources. Without it, the browser reports these values as zero, an empty string, or an empty array. For the list of affected properties, see Cross-origin restrictions in the {{domxref("PerformanceResourceTiming")}} reference.

The browser checks this header on cross-origin responses: same-origin resources expose full timing information without it.

This header is independent of CORS. Passing the CORS check doesn't grant access to detailed timing information. Conversely, Timing-Allow-Origin doesn't expose properties that describe the response itself, such as its body size, content type, or status code.

Syntax

Timing-Allow-Origin: *
Timing-Allow-Origin: <origin>, …, <originN>

Directives

• * (wildcard)
  • : Any origin may see timing resources.
• <origin>
  • : Specifies a URI that may see the timing resources. You can specify multiple origins, separated by commas.

Examples

Using Timing-Allow-Origin

To allow any resource to see timing resources:

Timing-Allow-Origin: *

To allow https://developer.mozilla.org to see timing resources, you can specify:

Timing-Allow-Origin: https://developer.mozilla.org

Specifications

{{Specifications}}

Browser compatibility

{{Compat}}

See also

• {{domxref("PerformanceResourceTiming")}}
• Resource Timing API
• {{HTTPHeader("Server-Timing")}} header
• {{HTTPHeader("Vary")}} header