Origin

Jump to:
  1. Syntax
  2. Directives
  3. Examples
  4. Specifications
  5. Browser compatibility
  6. See also

The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.

Note: The Origin header is not set on Fetch requests with a method of HEAD or GET (this behavior was corrected in Firefox 65 — seebug 1508661).

Header type Request header
Forbidden header name yes

Syntax

Origin: null
Origin: <scheme> "://" <hostname> [ ":" <port> ]

Directives

<scheme>
The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
<hostname>
The domain name of the server (for virtual hosting) or the IP.
<port> Optional
TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.

Examples

Origin: https://developer.mozilla.org

Specifications

Specification Comment
RFC 6454, section 7: Origin The Web Origin Concept
Fetch
The definition of 'Origin header' in that specification.		 Supplants the Origin header as defined in RFC6454.

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidEdge MobileFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Basic supportChrome Full support YesEdge Full support Yes
Notes
Full support Yes
Notes
Notes Not sent with POST requests, see bug 10482384.
Firefox Full support 59
Notes Disabled
Full support 59
Notes Disabled
Notes Sent with non-CORS requests since Fx59, unless they are GET or HEAD.
Disabled From version 59: this feature is behind the network.http.sendOriginHeader preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Partial support Partial
Notes
Notes Not sent with POST requests until Firefox 58, see bug 446344.
IE Full support YesOpera Full support YesSafari Full support YesWebView Android Full support YesChrome Android Full support YesEdge Mobile Full support YesFirefox Android Full support 59
Notes Disabled
Full support 59
Notes Disabled
Notes Sent with non-CORS requests since Fx59, unless they are GET or HEAD.
Disabled From version 59: this feature is behind the network.http.sendOriginHeader preference (needs to be set to true). To change preferences in Firefox, visit about:config.
Partial support Partial
Notes
Notes Not sent with POST requests until Firefox 58, see bug 446344.
Opera Android Full support YesSafari iOS Full support YesSamsung Internet Android Full support Yes

Legend

Full support  
Full support
See implementation notes.
See implementation notes.
User must explicitly enable this feature.
User must explicitly enable this feature.

See also

Document Tags and Contributors

Tags: 
Contributors to this page: mfuji09, chrisdavidmills, zemadz, fscholz, teoli
Last updated by: mfuji09,