• HTTP
  • HTTP
  • A typical HTTP session
  • HTTP caching
  • HTTP conditional requests
  • Protocol upgrade mechanism
  • HTTP Observatory
  • Permissions Policy Experimental
  • CORS errors
    1. Reason: CORS header 'Origin' cannot be added
    2. Reason: CORS request not HTTP
    3. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
    4. Reference
    5. Accept-Encoding
    6. Accept-Ranges
    7. Access-Control-Allow-Origin
    8. Access-Control-Request-Method
    9. Alt-Used
    10. Attribution-Reporting-Eligible Experimental
    11. Attribution-Reporting-Register-Source Experimental
    12. Attribution-Reporting-Register-Trigger Experimental
    13. Connection
    14. Content-DPR Non-standard Deprecated
    15. Content-Location
    16. Content-Type
    17. Critical-CH Experimental
    18. Date
    19. DNT Non-standard Deprecated
    20. Downlink Experimental
    21. DPR Non-standard Deprecated
    22. Early-Data Experimental
    23. ECT Experimental
    24. Expect-CT Deprecated
    25. Host
    26. If-Range
    27. Link
    28. NEL Experimental
    29. No-Vary-Search Experimental
    30. Observe-Browsing-Topics Experimental Non-standard
    31. Origin-Agent-Cluster Experimental
    32. Permissions-Policy Experimental
    33. Pragma Deprecated
    34. Range
    35. Report-To Non-standard Deprecated
    36. Reporting-Endpoints Experimental
    37. RTT Experimental
    38. Save-Data Experimental
    39. Sec-Browsing-Topics Experimental Non-standard
    40. Sec-CH-Prefers-Color-Scheme Experimental
    41. Sec-CH-Prefers-Reduced-Motion Experimental
    42. Sec-CH-Prefers-Reduced-Transparency Experimental
    43. Sec-CH-UA Experimental
    44. Sec-CH-UA-Arch Experimental
    45. Sec-CH-UA-Bitness Experimental
    46. Sec-CH-UA-Form-Factors Experimental
    47. Sec-CH-UA-Full-Version Deprecated
    48. Sec-CH-UA-Full-Version-List Experimental
    49. Sec-CH-UA-Mobile Experimental
    50. Sec-CH-UA-Model Experimental
    51. Sec-CH-UA-Platform Experimental
    52. Sec-CH-UA-Platform-Version Experimental
    53. Sec-CH-UA-WoW64 Experimental
    54. Sec-Fetch-User
    55. Sec-GPC Experimental
    56. Sec-WebSocket-Key
    57. Server-Timing
    58. Set-Cookie
    59. Set-Login Experimental
    60. Speculation-Rules Experimental
    61. Supports-Loading-Mode Experimental
    62. Tk Non-standard Deprecated
    63. Upgrade-Insecure-Requests
    64. Viewport-Width Non-standard Deprecated
    65. Warning Deprecated
    66. Width Non-standard Deprecated
    67. X-DNS-Prefetch-Control Non-standard
    68. X-Forwarded-For Non-standard
    69. X-Forwarded-Host Non-standard
    70. X-Forwarded-Proto Non-standard
    71. X-Permitted-Cross-Domain-Policies Non-standard
    72. X-Powered-By Non-standard
    73. X-Robots-Tag Non-standard
    74. X-XSS-Protection Non-standard Deprecated
  • GET
  • POST
  • 100 Continue
  • 200 OK
  • 204 No Content
  • 208 Already Reported
  • 302 Found
  • 308 Permanent Redirect
  • 403 Forbidden
  • 407 Proxy Authentication Required
  • 411 Length Required
  • 415 Unsupported Media Type
  • 421 Misdirected Request
  • 425 Too Early
  • 431 Request Header Fields Too Large
  • 502 Bad Gateway
  • 506 Variant Also Negotiates
  • 511 Network Authentication Required
  • CSP: block-all-mixed-content Deprecated
  • CSP: fenced-frame-src Experimental
  • CSP: frame-src
  • CSP: object-src
  • CSP: prefetch-src Non-standard Deprecated
  • CSP: report-uri Deprecated
  • CSP: require-trusted-types-for Experimental
  • CSP: script-src-elem
  • CSP: trusted-types Experimental
  • Permissions-Policy directives Experimental
    1. Permissions-Policy: accelerometer Experimental
    2. Permissions-Policy: ambient-light-sensor Experimental
    3. Permissions-Policy: attribution-reporting Experimental
    4. Permissions-Policy: autoplay Experimental
    5. Permissions-Policy: bluetooth Experimental
    6. Permissions-Policy: browsing-topics Experimental Non-standard
    7. Permissions-Policy: camera Experimental
    8. Permissions-Policy: compute-pressure Experimental
    9. Permissions-Policy: cross-origin-isolated Experimental
    10. Permissions-Policy: display-capture Experimental
    11. Permissions-Policy: document-domain Experimental
    12. Permissions-Policy: encrypted-media Experimental
    13. Permissions-Policy: fullscreen Experimental
    14. Permissions-Policy: gamepad Experimental
    15. Permissions-Policy: geolocation Experimental
    16. Permissions-Policy: gyroscope Experimental
    17. Permissions-Policy: hid Experimental
    18. Permissions-Policy: identity-credentials-get Experimental
    19. Permissions-Policy: idle-detection Experimental
    20. Permissions-Policy: local-fonts Experimental
    21. Permissions-Policy: magnetometer Experimental
    22. Permissions-Policy: microphone Experimental
    23. Permissions-Policy: midi Experimental
    24. Permissions-Policy: otp-credentials Experimental
    25. Permissions-Policy: payment Experimental
    26. Permissions-Policy: picture-in-picture Experimental
    27. Permissions-Policy: publickey-credentials-create Experimental
    28. Permissions-Policy: publickey-credentials-get Experimental
    29. Permissions-Policy: screen-wake-lock Experimental
    30. Permissions-Policy: serial Experimental
    31. Permissions-Policy: speaker-selection Experimental
    32. Permissions-Policy: storage-access Experimental
    33. Permissions-Policy: usb Experimental
    34. Permissions-Policy: web-share Experimental
    35. Permissions-Policy: window-management Experimental
    36. Permissions-Policy: xr-spatial-tracking Experimental
  • response header communicates one or more performance metrics about the request-response cycle to the user agent. It is used to surface backend server timing metrics (for example, database read/write, CPU time, file system access, etc.) in the developer tools in the user's browser or in the PerformanceServerTiming interface.

    Header type Response header
    Forbidden request header No
  • Syntax

    http
    / A single metric
    Server-Timing: <timing-metric>
    
    / Multiple metrics as a comma-separated list
    Server-Timing: <timing-metric>, …, <timing-metricN>
    

    A <timing-metric> has a name, and may include an optional duration and an optional description. For example:

    http
    / A metric with a name only
    Server-Timing: missedCache
    
    / A metric with a duration
    Server-Timing: cpu;dur=2.4
    
    / A metric with a description and duration
    Server-Timing: cache;desc="Cache Read";dur=23.2
    
    / Two metrics with duration values
    Server-Timing: db;dur=53, app;dur=47.2
    

    Directives

    <timing-metric>

    A comma-separated list of one or more metrics with the following components separated by semi-colons:

    <name>

    A name token (no spaces or special characters) for the metric that is implementation-specific or defined by the server, like cacheHit.

    <duration> Optional

    A duration as the string dur, followed by =, followed by a value, like dur=23.2.

    <description> Optional

    A description as the string desc, followed by =, followed by a value as a token or a quoted string, like desc=prod or desc="DB lookup".

    Names and descriptions should be kept as short as possible (for example, use abbreviations and omit optional values) to minimize HTTP data overhead.

    Description

    Privacy and security

    The Server-Timing header may expose potentially sensitive application and infrastructure information. Decide which metrics to send, when to send them, and who should see them based on the use case. For example, you may decide to only show metrics to authenticated users and nothing on public responses.

    PerformanceServerTiming interface

    In addition to having Server-Timing header metrics appear in the developer tools of the browser, the Timing-Allow-Origin header to specify the domains that are allowed to access the server metrics. The interface is only available in secure contexts (HTTPS) in some browsers.

    The components of the Server-Timing header map to the PerformanceServerTiming properties as follows:

    Examples

    Sending a metric using the Server-Timing header

    The following response includes a metric custom-metric with a duration of 123.45 milliseconds, and a description of "My custom metric":

    http
    Server-Timing: custom-metric;dur=123.45;desc="My custom metric"
    

    Server-Timing as HTTP trailer

    In the following response, the Trailer header is used to indicate that a Server-Timing header will follow the response body. A metric custom-metric with a duration of 123.4 milliseconds is sent.

    http
    HTTP/1.1 200 OK
    Transfer-Encoding: chunked
    Trailer: Server-Timing
    
    --- response body ---
    Server-Timing: custom-metric;dur=123.4
    

    Warning: Only the browser's DevTools can use the Server-Timing header as a HTTP trailer to display information in the Network -> Timings tab. The Fetch API cannot access HTTP trailers. See Browser compatibility for more information.

    Specifications

    Specification
    Server Timing
    # the-server-timing-header-field

    Browser compatibility

    BCD tables only load in the browser

    See also