probeo

What can a Server-Timing header give away?

server-timing:credential-exposure page

The issue

A Server-Timing header that carries more than timings hands it to every visitor. Its values show in any browser’s developer tools, so a token, an internal hostname or a file path written into it is readable by anyone who loads the page. The page works normally, which is why it stays there.

The cause is usually debugging output: a framework, an edge function or a proxy adding a description to its timing entries, with the request’s details in it.

Scope

The Server-Timing header of each response is checked. Ordinary metric names and durations, such as db;dur=53 or cache;desc="hit", aren’t reported; only what a value gives away is.

How to check you have it

  • In probeo: one of three findings:
    • server-timing:credential-exposure, graded critical, when a value holds something like api_key=, client_secret=, password=, access_token= or authorization: followed by a value of eight or more characters, or a URL with a username and password in it.
    • server-timing:private-host-exposure, graded major, for a private IP address (10.x, 172.16–172.31, 192.168.x, 127.x) or an internal hostname such as localhost or one ending in .internal, .local, .svc or .cluster.local.
    • server-timing:server-path-exposure, graded major, for a path under /etc, /var, /home, /srv, /opt or /app.
  • By hand: run curl -sI https://example.com/ | grep -i server-timing and read each entry’s desc.
  • With a tool: in Chrome or Edge DevTools, the Network panel’s Timing tab lists each Server-Timing entry for the request.

The fix

Send only metric names and durations in Server-Timing, or remove the header from public responses.

Find what adds the header, usually a framework setting, a middleware or an edge function, and strip its descriptions in production. If a credential appeared, treat it as exposed: rotate it, then remove it from the header.

Server-Timing: db;dur=53, render;dur=210, cache;desc="hit"

Done when: the header holds only names, durations and harmless descriptions, any exposed credential has been rotated, and the check above comes back clean.

Do not

  • Do not put request details, hostnames or file paths in a desc value.
  • Do not leave debugging output on in production.
  • Do not assume a credential is safe because the header is meant for performance data.

FAQ

Is Server-Timing itself a problem?

No. Metric names and durations are what it’s for, and probeo doesn’t report them. Only the values that give something away are reported.

Who can see the header?

Anyone who loads the page. Browsers expose Server-Timing to developer tools and to the page’s own scripts, so it isn’t private to the server.

The credential was only in the header briefly. Does it still need rotating?

Yes. A credential that has been sent to browsers can’t be recalled from anyone who saw or saved a response. Rotating it is the only way to be sure it no longer works.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.