Skip to main content
protocols.pageprotocols.page

Origin

RequestActive

The Origin header is sent on cross-origin requests (CORS) and WebSocket handshakes. It contains only the scheme, host, and port – never the path or query string. Servers use Origin to decide whether to allow the cross-origin request and which Access-Control-* headers to include in the response.

Origin: null | <scheme>://<hostname>[:<port>]

Description

Origin is sent by the browser on all cross-origin requests and on same-origin POST requests. Unlike Referer, Origin never includes path or query parameters – only the origin tuple (scheme + host + port). The server validates Origin against its CORS allow-list and responds with appropriate Access-Control-Allow-Origin headers.

Directives

DirectiveDescription
nullSent for opaque origins (file://, sandboxed iframes, redirected requests).
<scheme>://<host>:<port>The full origin of the requesting page. Port is omitted for 80/443.

Examples

Cross-origin request
http
POST /api/data HTTP/1.1
Origin: https://app.example.com
CORS preflight
http
OPTIONS /api/data HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: POST

Related

Access-Control-Allow-OriginAccess-Control-Allow-Methods

Specification

RFC 6454 – Origin specification →