Sec-Fetch-Site Header: Syntax and Examples

How Sec-Fetch-Site works

One of the Fetch Metadata headers, along with Sec-Fetch-Mode, Sec-Fetch-Dest and Sec-Fetch-User, which every current browser sends and JavaScript can’t forge. A few lines of server code can reject cross-site requests to sensitive endpoints, blocking CSRF and cross-site leaks, while still allowing normal navigation.

Values

Value	Meaning
`same-origin`	From a page on the same origin.
`same-site`	From another subdomain of the same site.
`cross-site`	From another website.
`none`	Typed into the address bar, a bookmark or similar user action.

Examples

A form posted from another site

Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Sec-Fetch-User: ?1

Common mistakes

A simple policy: allow requests with no Sec-Fetch-Site (old browsers, non-browser clients), same-origin, same-site, none, and cross-site top-level GET navigations; reject the rest.

Check it

# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Origin: tells the server which origin (scheme, host and port) a request comes from.
Cross-Origin-Resource-Policy: says which sites may load this resource with no-cors requests such as <img> and <script> (CORP).
Set-Cookie: stores a cookie in the browser, with attributes that control its lifetime, scope and security.

More requests, redirects and more headers

Location , Retry-After , User-Agent , Host , Link , Clear-Site-Data , Server-Timing .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Sec-Fetch-Site header do?

The Sec-Fetch-Site request header tells the server whether a request came from the same origin, the same site, another site, or the user directly. One of the Fetch Metadata headers, along with Sec-Fetch-Mode, Sec-Fetch-Dest and Sec-Fetch-User, which every current browser sends and JavaScript can’t forge. A few lines of server code can reject cross-site requests to sensitive endpoints, blocking CSRF and cross-site leaks, while still allowing normal navigation.

How do I see the Sec-Fetch-Site header?

Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".