# How many and which resources have Timing-Allow-Origin for Resource Timing?

**URL:** <https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152>\
**Category:** Analysis\
**Created:** [December 12, 2013, 11:22pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152 "2013-12-12T23:22:00Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevesoudersorg](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/stevesoudersorg/32/1293_2.png) [@stevesoudersorg](https://discuss.httparchive.org/u/stevesoudersorg)\
**Post date:** [December 12, 2013, 11:22pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/1 "2013-12-12T23:22:01Z")

</div>

Ilya’s post [Measuring network performance with Resource Timing API](http://googledevelopers.blogspot.com/2013/12/measuring-network-performance-with.html) had two pieces of information that surprised me:

- The Resource Timing API is supported in Chrome, Opera, and IE10+. I knew that each of these browsers had individually added support for Resource Timing, but I had never seen them listed together. These browsers represent a significant percentage of overall Web traffic so we can get some good stats with just these three.
- Facebook, Google, and Disqus worked together to add the [Timing-Allow-Origin](http://www.w3c-test.org/webperf/specs/ResourceTiming/#cross-origin-resources) response header. This is required to measure the timing of resource from a different origin (for privacy reasons). Some 3rd party content providers might be hesitant to allow website owners to measure 3rd party performance. It’s great that these companies took the first step.

I wanted to use the HTTP Archive data to see how many resources have the Timing-Allow-Origin response header and where they’re coming from.

The total number of requests for the Nov 15 2013 crawl is 27,889,759. Out of those, 342,957 have the Timing-Allow-Origin response header - that’s 1.2%. Not bad for early days.

```sql
SELECT count(*)
FROM [httparchive:runs.2013_11_15_requests]
total requsts = 27889759

SELECT count(*)
FROM [httparchive:runs.2013_11_15_requests]
WHERE lower(respOtherHeaders) contains "timing-allow-origin"

```

Facebook and Google are the most popular domains serving these resources, but other content providers like Spil Games and [Odnoklassniki.ru](http://Odnoklassniki.ru) are also showing support:

```sql
SELECT domain(url) as domain, count(*) as num
FROM [httparchive:runs.2013_11_15_requests]
WHERE lower(respOtherHeaders) contains "timing-allow-origin"
GROUP BY domain ORDER BY num desc

```

![](https://yyz1.discourse-cdn.com/flex035/uploads/httparchive/104/ffffde505a3b60a4.png)

Facebook and Google have the most popular resources being served with this header:

```sql
SELECT url, count(*) as num
FROM [httparchive:runs.2013_11_15_requests]
WHERE lower(respOtherHeaders) contains "timing-allow-origin"
GROUP BY url ORDER BY num desc

```

![](https://yyz1.discourse-cdn.com/flex035/uploads/httparchive/106/fd043c610f8d381f.png)

I’d love to see Google Analytics, Twitter, and Doubleclick add this response header so website owners can better understand what’s having an impact on their page’s load times.

---

<div class="post-metadata">

**Author:** ![bluesmoon](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/bluesmoon/32/1303_2.png) [@bluesmoon](https://discuss.httparchive.org/u/bluesmoon)\
**Post date:** [December 12, 2013, 11:27pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/2 "2013-12-12T23:27:44Z")

</div>

Happy to see this. mPulse also includes the timing-allow-origin response on boomerang requests.

---

<div class="post-metadata">

**Author:** ![igrigorik](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/igrigorik/32/925_2.png) [@igrigorik](https://discuss.httparchive.org/u/igrigorik)\
**Post date:** [December 13, 2013, 12:17am UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/3 "2013-12-13T00:17:34Z")

</div>

Awesome. Hope to see this more popular widget / library providers on this list soon!

Quick note: It’ll be interesting to rerun this list on the Dec 15th crawl. Back in November we were still in early stages of rolling out RT support across Google Fonts / Google+ / Google Libraries (CDN). I expect those numbers to be much higher in the next run!

---

<div class="post-metadata">

**Author:** ![marcelduran](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/marcelduran/32/1296_2.png) [@marcelduran](https://discuss.httparchive.org/u/marcelduran)\
**Post date:** [April 30, 2014, 5:04pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/4 "2014-04-30T17:04:25Z")

</div>

For those having **Timing-Allow-Origin** header, no one is setting it to anything other than “\*”

```
SELECT url, respOtherHeaders, count(*) as num
FROM [httparchive:runs.latest_requests]
WHERE
  lower(respOtherHeaders) contains "timing-allow-origin" and
  not lower(respOtherHeaders) contains "timing-allow-origin = *"
GROUP BY url, respOtherHeaders ORDER BY num desc

```

There are only a few occurrences, mainly garbage from _[qpic.cn](http://qpic.cn)_ for both desktop and mobile.  
 ![](https://yyz1.discourse-cdn.com/flex035/uploads/httparchive/170/a565fefad5240019.png)

---

<div class="post-metadata">

**Author:** ![stevesoudersorg](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/stevesoudersorg/32/1293_2.png) [@stevesoudersorg](https://discuss.httparchive.org/u/stevesoudersorg)\
**Post date:** [June 24, 2014, 9:14pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/5 "2014-06-24T21:14:01Z")

</div>

> [@stevesoudersorg](#):
>
> lower(respOtherHeaders) contains “timing-allow-origin”

Update May 15 2014: In the May 15 crawl there were 1,392,034 responses with Timing-Allow-Origin out of 27655500 total requests (5%). A nice increase!

---

<div class="post-metadata">

**Author:** ![elbpdx](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/elbpdx/32/469_2.png) [@elbpdx](https://discuss.httparchive.org/u/elbpdx)\
**Post date:** [January 14, 2015, 1:50am UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/6 "2015-01-14T01:50:01Z")

</div>

> [@stevesoudersorg](#):
>
> lower(respOtherHeaders) contains “timing-allow-origin”

Update - In the Jan 01 2015 crawl, there were 44,981,766 requests with 2,902,254 set with “timing-allow-origin” - 6.5%

---

<div class="post-metadata">

**Author:** ![NicJ](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/nicj/32/672_2.png) [@NicJ](https://discuss.httparchive.org/u/NicJ)\
**Post date:** [March 19, 2018, 3:16am UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/7 "2018-03-19T03:16:44Z")

</div>

February 15 crawl: 6,942,158 out of 50,088,983 requests (13.86%)

---

<div class="post-metadata">

**Author:** ![rviscomi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/rviscomi/32/835_2.png) [@rviscomi](https://discuss.httparchive.org/u/rviscomi)\
**Post date:** [March 19, 2018, 8:49pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/8 "2018-03-19T20:49:31Z")

</div>

Love to see this periodically updated with the latest data.

I put together a query to generate a timeseries:

```sql
#standardSQL
SELECT
  REPLACE(SUBSTR(_TABLE_SUFFIX, 0, 10), '_', '-') AS date,
  SUM(IF(LOWER(respOtherHeaders) LIKE "%timing-allow-origin%", 1, 0)) / COUNT(0) AS pctAllowTiming
FROM
  `httparchive.summary_requests.*`
WHERE
  ENDS_WITH(_TABLE_SUFFIX, 'desktop')
GROUP BY
  date
ORDER BY
  date

```

[Run it on BigQuery](https://bigquery.cloud.google.com/savedquery/226352634162:880d741bc60f485e94ae7b2dee8e71c7) _( **warning** : this query consumes 431 GB, about half of the free monthly quota)_

The growth is slow but steady.

[![image](https://canada1.discourse-cdn.com/flex035/uploads/httparchive/original/2X/1/16db5b0b46d185990a2de7e721b8de063d5beeaf.png)](https://docs.google.com/spreadsheets/d/1NBLuCkdTLDU3Fv95u6vB-F78rBQoHWV6hZ9uav1BL_w/edit?usp=sharing)

[Explore the raw results](https://docs.google.com/spreadsheets/d/1NBLuCkdTLDU3Fv95u6vB-F78rBQoHWV6hZ9uav1BL_w/edit?usp=sharing)

If there’s interest, I could put together a report on the [beta.httparchive.org](http://beta.httparchive.org) site of popular HTTP headers and track adoption across desktop/mobile.

---

<div class="post-metadata">

**Author:** ![rviscomi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/rviscomi/32/835_2.png) [@rviscomi](https://discuss.httparchive.org/u/rviscomi)\
**Post date:** [April 23, 2019, 3:26pm UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/9 "2019-04-23T15:26:06Z")

</div>

Revisiting this thread. I’m curious not just how many response headers include TAO but specifically whether resources are Resource Timing enabled, meaning that it is either a same-origin resource or its TAO value is permissive (`*` or the same origin).

Here’s an example of a query to get the latest data for desktop:

```sql
CREATE TEMP FUNCTION isTimingAllowed(origin STRING, url STRING, payload STRING)
RETURNS BOOLEAN
LANGUAGE js AS """
  // Same-origin is always allowed.
  if (url.startsWith(origin)) return true;
  
  try {
    var $ = JSON.parse(payload);
    var TAO = $.response.headers.filter(({name}) => name.toLowerCase() === 'timing-allow-origin');
    return TAO && ['*', origin].includes(TAO.value);
  } catch (e) {
    return false;
  }
""";

SELECT
  SUM(IF(isTimingAllowed(RTRIM(page, '/'), url, payload), 1, 0)) / COUNT(0) AS pct_timing_allowed
FROM
  `httparchive.latest.requests_desktop`

```

I needed to use a UDF to parse the JSON and determine whether the TAO value was permissive. The alternative would have been regex parsing the `respOtherHeaders` which is ok and cheaper to query, but I like the structured schema of the `requests` table JSON payload.

Here’s a graph of the data for all dates and desktop/mobile (significantly more expensive to query):

![image](https://cdck-file-uploads-canada1.s3.dualstack.ca-central-1.amazonaws.com/flex035/uploads/httparchive/original/2X/f/fe32ca6c2b97b8566ce856ee6bb8e64ae751593a.png)

The latest stats put Resource Timing support at about 40% of all resources.

There are some bizarre downward trends, which I can only guess are decays due to the staleness of the sample URLs. Each big jump you see is when we updated (and increased) our sample URLs.

---

<div class="post-metadata">

**Author:** ![rockeynebhwani](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/rockeynebhwani/32/1775_2.png) [@rockeynebhwani](https://discuss.httparchive.org/u/rockeynebhwani)\
**Post date:** [July 13, 2020, 12:24am UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/10 "2020-07-13T00:24:37Z")

</div>

@rviscomi - What will be useful here is to report top third parties which are missing TAO ? I guess there will be some big ones in this list (e.g. Pinterest) and publishing the list of top third parties missing TAO can be a good addition for third parties chapter in Web Almanac 2020.

---

<div class="post-metadata">

**Author:** ![rviscomi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.httparchive.org/rviscomi/32/835_2.png) [@rviscomi](https://discuss.httparchive.org/u/rviscomi)\
**Post date:** [July 13, 2020, 3:05am UTC](https://discuss.httparchive.org/t/how-many-and-which-resources-have-timing-allow-origin-for-resource-timing/152/11 "2020-07-13T03:05:23Z")

</div>

Yes, thats a good suggestion @rockeynebhwani! Could you note that in the 3P chapter [issue](https://github.com/HTTPArchive/almanac.httparchive.org/issues/901) and/or [doc](https://docs.google.com/document/d/1x8hhGIVYxvcDb3G4HGryW3yIOgLpvsNtQ_iHc_dMLEs/edit?usp=sharing)?