Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with
POST requests. It is similar to the
Referer header, but, unlike this header, it doesn't disclose the whole path.
|Header type||Request header|
|Forbidden header name||yes|
Origin: "" Origin: <scheme> "://" <host> [ ":" <port> ]
Origin can be the empty string: this is useful, for example, if the source is a
- The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
- The domain name of the server (for virtual hosting) or the IP.
- <port> Optional
- TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.
|RFC 6454, section 7: Origin||The Web Origin Concept|
The definition of 'Origin header' in that specification.
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
|Feature||Android webview||Chrome for Android||Edge mobile||Firefox for Android||IE mobile||Opera Android||iOS Safari|
1. Not sent with
POST requests, see bug 10482384.
2. Not sent with
POST requests, see bug 446344.