Origin

The Origin request header indicates where a request originates from. It doesn't include any path information. It is similar to the Referer header, but, unlike that header, it doesn't disclose the whole path.

Note

Basically, browsers add the Origin request header to:

There are some exceptions to the above rules; for example if a cross-origin request is made in no-cors mode the Origin header will not be added.

Header type Request header
Forbidden header name yes

Syntax

Origin: null
Origin: <scheme> "://" <hostname> [ ":" <port> ]

Directives

<scheme>
The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
<hostname>
The domain name of the server (for virtual hosting) or the IP.
<port> Optional
TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.

Examples

Origin: https://developer.mozilla.org

Specifications

Specification Comment
RFC 6454, section 7: Origin The Web Origin Concept
Fetch
The definition of 'Origin header' in that specification.		 Supplants the Origin header as defined in RFC6454.

Browser compatibility

BCD tables only load in the browser

See also