Timing-Allow-Origin header
The HTTP Timing-Allow-Origin response header specifies origins that are allowed to see values of attributes retrieved via features of the Resource Timing API that are otherwise restricted for cross-origin resources.
Without it, the browser reports these values as zero, an empty string, or an empty array.
For the list of affected properties, see Cross-origin restrictions in the PerformanceResourceTiming reference.
The browser checks this header on cross-origin responses: same-origin resources expose full timing information without it.
This header is independent of CORS.
Passing the CORS check doesn't grant access to detailed timing information.
Conversely, Timing-Allow-Origin doesn't expose properties that describe the response itself, such as its body size, content type, or status code.
| Header type | [Response header](https://developer.mozilla.org/en-US/docs/Glossary/Response%20header) |
|---|
Syntax
Timing-Allow-Origin: *
Timing-Allow-Origin: <origin>, …, <originN>
Directives
*(wildcard)- : Any origin may see timing resources.
<origin>- : Specifies a URI that may see the timing resources. You can specify multiple origins, separated by commas.
Examples
Using Timing-Allow-Origin
To allow any resource to see timing resources:
Timing-Allow-Origin: *
To allow https://developer.mozilla.org to see timing resources, you can specify:
Timing-Allow-Origin: https://developer.mozilla.org
Specifications
Browser compatibility
See also
- PerformanceResourceTiming
- Resource Timing API
- Server-Timing header
- Vary header