Origin request header indicates the origin (scheme, hostname, and port) that caused the request.
For example, if a user agent needs to request resources included in a page, or fetched by scripts that it executes, then the origin of the page may be included in the request.
|Header type||Request header|
|Forbidden header name||yes|
Origin: null Origin: <scheme>://<hostname> Origin: <scheme>://<hostname>:<port>
The origin is "privacy sensitive", or is an opaque origin as defined by the HTML specification (specific cases are listed in the description section).
The protocol that is used. Usually, it is the HTTP protocol or its secured version, HTTPS.
The domain name or the IP address of the origin server.
Port number on which the server is listening. If no port is given, the default port for the requested service is implied (e.g., "80" for an HTTP URL) .
Origin header is similar to the
Referer header, but does not disclose the path, and may be
It is used to provide the "security context" for the origin request, except in cases where the origin information would be sensitive or unnecessary.
Broadly speaking, user agents add the
Origin request header to:
- cross origin requests.
- same-origin requests except for
HEADrequests (i.e. they are added to same-origin
Origin header value may be
null in a number of cases, including (non-exhaustively):
- Origins whose scheme is not one of
- Cross-origin images and media data, including that in
- Documents created programmatically using
createDocument(), generated from a
data:url, or that do not have a creator browsing context.
- Redirects across origins.
- iframes with a sandbox attribute that doesn’t contain the value
- Responses that are network errors.
Note: There is a more detailed listing of case that may return
null on Stack Overflow here: When do browsers send the Origin header? When do browsers set the origin to null?.
|The Web Origin Concept |
|Fetch Standard (Fetch)|
BCD tables only load in the browser