How Origin works
Browsers send it on cross-origin requests and on POST, PUT and DELETE requests even to the same origin. Unlike Referer it never includes a path. Servers use it for CORS decisions and as a cheap CSRF check: reject state-changing requests whose Origin isn’t yours.
Examples
Origin: https://app.example.comCommon mistakes
- JavaScript can’t set or change Origin; it is a forbidden header. Non-browser clients can send anything, so Origin checks protect users, not your API.
Check it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.
- Referrer-Policy: controls how much of the current URL is sent in the Referer header when users follow links or load resources.
- Sec-Fetch-Site: tells the server whether a request came from the same origin, the same site, another site, or the user directly.
More cors headers
Access-Control-Allow-Credentials , Access-Control-Allow-Methods , Access-Control-Allow-Headers , Access-Control-Expose-Headers , Access-Control-Max-Age .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Origin header do?
The Origin request header tells the server which origin (scheme, host and port) a request comes from. Browsers send it on cross-origin requests and on POST, PUT and DELETE requests even to the same origin. Unlike Referer it never includes a path. Servers use it for CORS decisions and as a cheap CSRF check: reject state-changing requests whose Origin isn’t yours.
How do I see the Origin header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".