I have a logout endpoint that takes several seconds to resolve in Chrome (sometimes up to 30 seconds in production), but only around a hundred milliseconds in every other browsers (Firefox, Safari...) and in a new Chrome Incognito window. Firing the request locally from Chrome against the staging database also runs smoothly. Checking the Timing tab in Network shows that timing for Request sent and Waiting are normal, but Content Download is where most of the time is spent.
I have tried turning off all my extensions (and rebooted Chrome) and tried browsing the Chromium bugs board, to no avail:
- slow content download
- Network panel shows huge Content Download time for 304 response
- Slow Content Download on Chrome
Here's the request:
curl "https://XXX.XXX.com/deconnexion" \
-H 'Authority: XXX.XXX.fr' \
-H 'Pragma: no-cache' \
-H 'Cache-Control: no-cache' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' \
-H 'Referer: https://XXX.XXX.fr/b' \
-H 'Accept-Encoding: gzip, deflate, br' \
-H 'Accept-Language: en-US,en;q=0.9,fr;q=0.8,es;q=0.7' \
-H 'Cookie: __cfduid=XXX; cookie_consent=true;'
Which returns an empty response with the following Headers:
cache-control: no-cache
cf-ray: 49365c40589abd79-CDG
clear-site-data: "cache", "storage"
content-type: text/html; charset=utf-8
date: Thu, 03 Jan 2019 15:04:52 GMT
expect-ct: max-age=604800, report-uri="https://xxx.cloudflare.com/xxx/xxx/xxx"
location: https://xxx.xxx.fr/xxx/xxx
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
set-cookie: path=/; secure; HttpOnly
status: 302
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-csrf-token: xxxx
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: xx-xx-xx-xx-xx
x-runtime: 0.017715
x-xss-protection: 1; mode=block
Request in Firefox:
Request in Chrome Incognito:
Request in Chrome 71 (version 71.0.3578.98):
UPDATE: Removing the 'Clear-Site-Data' response header solved the issue, but I still have no idea why...


