demo · v132
TAO-allowed vs coarsened — side-by-side
Load two cross-origin images. One source serves Timing-Allow-Origin: *, the other doesn't. Observe the LCP / element-timing entries for both and compare: full-precision (TAO) vs 4 ms-quantised (coarse). The whole point of the v132 change is that the right-hand column used to be a zero.
Both images are loaded from public hosts. picsum.photos returns TAO: *;
placehold.co does not. The numbers below reflect the actual headers seen in your browser.
image A — TAO present
— ms renderTime
| field | value |
|---|
image B — no TAO
— ms renderTime
| field | value |
|---|
Before v132, image B's
renderTime was zero — you had to fall back to loadTime or assume render ≈ load. From v132 the renderer reports a real number coarsened to a 4 ms multiple. Good enough for real-user monitoring, low-precision enough to resist timing-attack reconstruction.