go-server-timing
go-server-timing copied to clipboard
Be less precise about timings
Currently durations are rendered as:
strconv.FormatFloat(float64(m.Duration)/float64(time.Millisecond), 'f', -1, 64)
I think this is over precise: all digits beyond millisecond? That could even be a security issue as somebody could do timing attacks determining how long some operation is taking (e.g., password checking). I think there is really no point in sending more than 1 extra digit after milliseconds. I mean, how precise those measurements are anyway, no? They are not an average of multiple measurements.
So I suggest:
strconv.FormatFloat(float64(m.Duration)/float64(time.Millisecond), 'f', 1, 64)
I could be convinced to increase 1, but not to have it unbounded.
I made #25.