Origin

The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.

Note: The Origin header is not set on Fetch requests with a method of HEAD or GET (this behavior was corrected in Firefox 65 — seebug 1508661).

Header type	Request header
Forbidden header name	yes

Syntax

Origin: null
Origin: <scheme> "://" <hostname> [ ":" <port> ]

Directives

<scheme>: The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
<hostname>: The domain name of the server (for virtual hosting) or the IP.
<port> Optional: TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.

Examples

Origin: https://developer.mozilla.org

Specifications

Specification	Comment
RFC 6454, section 7: Origin	The Web Origin Concept
Fetch The definition of 'Origin header' in that specification.	Supplants the `Origin` header as defined in RFC6454.

Browser compatibility

Update compatibility data on GitHub

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`Origin`	Chrome Full support Yes	Edge Full support Yes Notes Full support Yes Notes Notes Not sent with `POST` requests, see bug 10482384.	Firefox Full support 59 Notes Disabled Full support 59 Notes Disabled Notes Sent with non-CORS requests since Fx59, unless they are `GET` or `HEAD`. Disabled From version 59: this feature is behind the `network.http.sendOriginHeader` preference (needs to be set to `true`). To change preferences in Firefox, visit about:config. Partial support Partial Notes Notes Not sent with `POST` requests until Firefox 58, see bug 446344.	IE Full support Yes	Opera Full support Yes	Safari Full support Yes	WebView Android Full support Yes	Chrome Android Full support Yes	Firefox Android Full support 59 Notes Disabled Full support 59 Notes Disabled Notes Sent with non-CORS requests since Fx59, unless they are `GET` or `HEAD`. Disabled From version 59: this feature is behind the `network.http.sendOriginHeader` preference (needs to be set to `true`). To change preferences in Firefox, visit about:config. Partial support Partial Notes Notes Not sent with `POST` requests until Firefox 58, see bug 446344.	Opera Android Full support Yes	Safari iOS Full support Yes	Samsung Internet Android Full support Yes

Legend

Full support: Full support
See implementation notes.: See implementation notes.
User must explicitly enable this feature.: User must explicitly enable this feature.