Sec-Fetch-Dest
RequestActiveSec-Fetch-Dest indicates the destination of a fetch request – the type of content being requested. Values include: document, image, script, style, font, worker, manifest, audio, video, empty (for XHR/fetch). Servers use this to reject requests that don't match the expected content type.
Sec-Fetch-Dest: audio | document | embed | empty | font | image | manifest | object | report | script | serviceworker | sharedworker | style | track | video | worker | xslt
Description
Sec-Fetch-Dest tells the server what the browser intends to do with the response. A request for a script has Sec-Fetch-Dest: script. A regular fetch() API call has Sec-Fetch-Dest: empty. A top-level navigation has Sec-Fetch-Dest: document. This allows fine-grained resource isolation policies – for example, an API endpoint can reject requests where Dest is not 'empty', indicating a non-programmatic request.
Examples
Script request
http
GET /app.js HTTP/1.1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-corsAPI fetch
http
GET /api/users HTTP/1.1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors