W3cubDocs

Origin

The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.

Header type	Request header
Forbidden header name	yes

Syntax

Origin: ""
Origin: <scheme> "://" <host> [ ":" <port> ]

Origin can be the empty string: this is useful, for example, if the source is a data URL.

Directives

<scheme>: The protocol that is used. Usually it is the HTTP protocol or its secured version, HTTPS.
<host>: The domain name of the server (for virtual hosting) or the IP.
<port> Optional: TCP port number on which the server is listening. If no port is given, the default port for the service requested (e.g., "80" for an HTTP URL) is implied.

Examples

Origin: https://developer.mozilla.org

Specifications

Specification	Comment
RFC 6454, section 7: Origin	The Web Origin Concept
Fetch The definition of 'Origin header' in that specification.	Supplants the `Origin` header as defined in RFC6454.

Browser compatibility

Feature	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari
Basic support	Yes	Yes¹	Yes²	Yes	Yes	Yes

Feature	Android webview	Chrome for Android	Edge mobile	Firefox for Android	IE mobile	Opera Android	iOS Safari
Basic support	Yes	Yes	Yes	Yes²	Yes	Yes	Yes

1. Not sent with POST requests, see bug 10482384.