{{HTTPSidebar}}
The Origin
request header specifies indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent in requests where a {{Glossary("CORS")}} flag is set as well as in {{HTTPMethod("POST")}} requests.
Header type | {{Glossary("Request header")}} |
---|---|
{{Glossary("Forbidden header name")}} | yes |
Syntax
Origin: "" Origin: <scheme> "://" <host> [ ":" <port> ]
Origin
can be the empty string; this is useful, for example, if the source is a data
URL.
Directives
- <scheme>
- The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
- <host>
- The domain name of the server (for virtual hosting) or the IP.
- <port> {{optional_inline}}
- TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.
Examples
Origin: https://developer.mozilla.org
Specifications
Specification | Title |
---|---|
{{RFC("6454", "Origin", "7")}} | The Web Origin Concept |
{{SpecName('Fetch','#origin-header','Origin header')}} | Supplants the Origin header as defined in RFC6454. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
{{Compat}}
See also
- {{HTTPHeader("Host")}}
- {{HTTPHeader("Referer")}}
- Same-origin policy