Spec: https://w3c.github.io/resource-timing/#dfn-timing-allow-check

The timing allow check algorithm, which checks whether a resource's timing information can be shared with the current document, is as follows:

1. If the resource is same origin, return pass.
2. If the Timing-Allow-Origin header value list contains a case-sensitive match for the value of the origin of the current document, or a wildcard ("*"), return pass.
3. Return fail.

If the last non-redirected fetch of the resource fails the timing allow check, the user agent MUST set redirectStart, redirectEnd, domainLookupStart, domainLookupEnd, connectStart, connectEnd, requestStart, responseStart and secureConnectionStart to zero

This check can also affect startTime.