跳转到主要内容

Timing-Allow-Origin header

The HTTP Timing-Allow-Origin {{Glossary("response header")}}header specifies origins that are allowed to see values of attributes retrieved via features of the Resource Timing API that are otherwise restricted for cross-origin resources. Without it, the browser reports these values as zero, an empty string, or an empty array. For the list of affected properties, see Cross-origin restrictions in the {{domxref("PerformanceResourceTiming")}}PerformanceResourceTiming reference.

The browser checks this header on cross-origin responses: same-origin resources expose full timing information without it.

This header is independent of CORS. Passing the CORS check doesn't grant access to detailed timing information. Conversely, Timing-Allow-Origin doesn't expose properties that describe the response itself, such as its body size, content type, or status code.

Header type {{Glossary("[Response header")}}header](https://developer.mozilla.org/en-US/docs/Glossary/Response%20header)

Syntax

Timing-Allow-Origin: *
Timing-Allow-Origin: <origin>, …, <originN>

Directives

  • * (wildcard)
    • : Any origin may see timing resources.
  • <origin>
    • : Specifies a URI that may see the timing resources. You can specify multiple origins, separated by commas.

Examples

Using Timing-Allow-Origin

To allow any resource to see timing resources:

Timing-Allow-Origin: *

To allow https://developer.mozilla.org to see timing resources, you can specify:

Timing-Allow-Origin: https://developer.mozilla.org

Specifications

{{Specifications}}

Browser compatibility

{{Compat}}

See also