← Cross-origin redirect timing opt-in

v151 · navigation timing · attribute reference

PerformanceNavigationTiming.redirectCount

The number of redirects the navigation went through. Since Chrome 151 this is also reported for cross-origin chains — but only when every redirect in the chain opted the destination origin in via Timing-Allow-Origin; otherwise it stays zero.

Syntax

// W3C Navigation Timing — PerformanceNavigationTiming (normative IDL)
readonly attribute unsigned short redirectCount;

// Read it from the navigation entry:
const count = performance.getEntriesByType("navigation")[0].redirectCount;
Source: Navigation Timing — redirectCount

Inputs

A read-only attribute — it takes no inputs from the page. What determines its value is the navigation itself: the request's redirect count and whether the chain qualifies for exposure. The exact rule: a chain with no cross-origin redirects always exposes; otherwise every redirect response in the chain — same-origin hops included — must have opted the destination in, and the request's client must be null or its referrer not no-referrer.

Source: whatwg/html PR #12513 (the exposure conditional)

Outputs

An unsigned short. Per the HTML navigation steps, the entry's redirect count starts at 0 and is set to the request's actual redirect count only when the response has no cross-origin redirects, or all of these hold: the request's client is null or its referrer is not no-referrer, and the navigation TAO check over the chain's collected Timing-Allow-Origin values returns success for the destination origin.

Source: whatwg/html PR #12513; Fetch Standard — navigation TAO check

Errors

No exceptions. The failure mode is informational: 0 is ambiguous — it means “no redirects”, or “the chain has cross-origin redirects and some hop (cross-origin or same-origin) did not opt in”, or “the chain has cross-origin redirects and the navigation was no-referrer with a non-null client”. Measurement code must treat 0 as “not exposed”, not as proof of a direct navigation.

Source: whatwg/html PR #12513

Context

Receiver: the PerformanceNavigationTiming entry for the current document — the first (and only) entry of type "navigation" in the performance timeline.

Exposure: window contexts (navigation timing is a document concept). The cross-origin exposure addition is Chrome 151 per the milestone listing; the general attribute is much older (BCD: Chrome 57, Firefox 58, Safari 15).

Implementation: Chromium's getters in performance_navigation_timing.cc return 0 unless the load's cross-origin-redirect-timing exposure flag is set. Availability: runtime feature NavigationTimingRedirectTimingViaTAO (status stable at trunk).

Source: Navigation Timing — redirectCount; Chromium runtime_enabled_features.json5; chromestatus.com/feature/5078310347472896

Lifecycle

The value is fixed when the navigation timing entry is created during document commit — it does not change afterwards. The redirect count itself is fetch bookkeeping: it increments per redirect followed, and the collected Timing-Allow-Origin values are checked once, when the destination origin is known.

Source: WHATWG HTML — navigation timing entry creation; Fetch Standard — navigation timing allow values list

Examples

const [nav] = performance.getEntriesByType("navigation");
switch (true) {
  case nav.redirectCount > 0:
    console.log(`chain of ${nav.redirectCount} — fully opted in`);
    break;
  default:
    // 0 could mean: direct load, withheld opt-in, or no-referrer nav.
    // Combine with document.referrer and your own redirects to disambiguate.
    console.log("redirect count not exposed");
}
Source: whatwg/html PR #12513

Compatibility

redirectCount cross-origin exposure — interim, from ChromeStatus (checked 2026-07-26)
Engine / runtimeSupportNotes
Chrome151Cross-origin exposure added (desktop, Android, WebView per the feature detail); the general attribute ships since Chrome 57 per BCD
EdgeNot separately reportedNo Edge position recorded on ChromeStatus
FirefoxNo signalGeneral attribute since Firefox 58 per BCD; no signal on the cross-origin exposure
SafariRecorded positive signalGeneral attribute since Safari 15 per BCD; a recorded signal, not an official position

General-property BCD: api/PerformanceNavigationTiming.json. Feature signals: ChromeStatus API feature record.

Source: ChromeStatus API feature record; BCD api/PerformanceNavigationTiming.json

Security and privacy

Zero remains the privacy-preserving default: a cross-origin chain's length is disclosed only with every redirect operator's explicit opt-in (every hop, same-origin ones included), and — for chains with cross-origin redirects — never for no-referrer navigations with a non-null client. The attribute itself is read-only, same-context, and reveals nothing about redirect URLs or response contents — only how many redirects occurred and (via the sibling time fields) when.

Source: whatwg/html PR #12513; whatwg/fetch PR #1931