The Origin
request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST
requests. It is similar to the Referer
header, but, unlike this header, it doesn't disclose the whole path.
Note: The Origin
header is not set on Fetch requests with a method of HEAD
or GET
(this behavior was corrected in Firefox 65 — see bug 1508661).
Header type | Request header |
---|---|
Forbidden header name | yes |
Syntax
Origin: null Origin: <scheme> "://" <hostname> [ ":" <port> ]
Directives
- <scheme>
- The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
- <hostname>
- The domain name of the server (for virtual hosting) or the IP.
- <port> Optional
- TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.
Examples
Origin: https://developer.mozilla.org
Specifications
Specification | Comment |
---|---|
RFC 6454, section 7: Origin | The Web Origin Concept |
Fetch The definition of 'Origin header' in that specification. |
Supplants the Origin header as defined in RFC6454. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Origin | Chrome Full support Yes | Edge
Full support
12
| Firefox
Full support
70
| IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android
Full support
59
| Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
Legend
- Full support
- Full support
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.