Re: Cross-Origin Resources and Resource Timing

Getting the overall time is already helpful while it makes diagnosing problems really hard missing the details. I have to say I am no security expert, so I am not the right person to judge the security implications.  It might be a good idea to state the security concerns in a non-normative section. As Pat pointed out third party providers will have to be convinced to support the new header. Having a strong reference like a W3C standard would be helpful here.

I was actually more concerned that a third-party script can access timing information of the page that loaded it. I would not want third party JavaScript like an ad-provider see what I load on my page.

// Alois