Skip to main content
protocols.pageprotocols.page

Sec-Fetch-Mode

RequestActive

Sec-Fetch-Mode indicates how the request was initiated – navigate (top-level navigation), cors (CORS request), no-cors (non-CORS cross-origin), same-origin, or websocket. Servers use this to distinguish navigation requests from API calls and block unexpected request modes.

Sec-Fetch-Mode: cors | navigate | no-cors | same-origin | websocket

Description

Sec-Fetch-Mode reflects the mode used by the Fetch API or browser navigation. 'navigate' means the browser is navigating (user clicked a link or submitted a form). 'cors' means a CORS-enabled fetch. 'no-cors' means a cross-origin request without CORS. 'same-origin' means a same-origin fetch. 'websocket' means a WebSocket upgrade. This lets servers apply different security policies per mode.

Examples

Navigation
http
GET /page HTTP/1.1
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
CORS API call
http
GET /api/data HTTP/1.1
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

Related

Sec-Fetch-SiteSec-Fetch-Dest

Specification

W3C Fetch Metadata – Sec-Fetch-Mode specification →