zakirkun Server Timing Information Leak
Overview
The Server-Timing HTTP header exposes timing information about server-side operations to browsers. While useful for performance profiling, it can reveal:
- Internal service names (database, cache, microservices)
- Query execution times (aids SQL injection timing attacks)
- Internal architecture details
Remediation
- Remove Server-Timing headers in production
- If needed for monitoring, limit to non-sensitive metric names
- Restrict Server-Timing to same-origin via
Timing-Allow-Originheader