We're looking for a person or people to help audit MDN to find places we could speed up. Is this you or someone you know? Check out the RFP: https://mzl.la/2IHcMiE

Our volunteers haven't translated this article into 한국어 yet. Join us and help get the job done!
You can also read the article in English (US).

The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.

Header type Request header
Forbidden header name yes


Origin: ""
Origin: <scheme> "://" <hostname> [ ":" <port> ]

Origin can be the empty string: this is useful, for example, if the source is a data URL.


The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
The domain name of the server (for virtual hosting) or the IP.
<port> Optional
TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.


Origin: https://developer.mozilla.org


Specification Comment
RFC 6454, section 7: Origin The Web Origin Concept
The definition of 'Origin header' in that specification.
Supplants the Origin header as defined in RFC6454.

Browser compatibility

FeatureChromeEdgeFirefoxInternet ExplorerOperaSafari
Basic support Yes Yes1 Yes2 Yes Yes Yes
FeatureAndroid webviewChrome for AndroidEdge mobileFirefox for AndroidOpera AndroidiOS SafariSamsung Internet
Basic support Yes Yes Yes Yes2 Yes Yes ?

1. Not sent with POST requests, see bug 10482384.

2. Not sent with POST requests, see bug 446344.

See also

문서 태그 및 공헌자

 이 페이지의 공헌자: zemadz, fscholz, teoli
 최종 변경: zemadz,