Skip to main content
protocols.pageprotocols.page

Sec-Fetch-Site

RequestActive

Sec-Fetch-Site is a Fetch metadata header that indicates the relationship between the origin that initiated the request and the request's target origin. Servers use it for CSRF protection without tokens – if Sec-Fetch-Site is 'cross-site' and the request is not expected from external origins, reject it.

Sec-Fetch-Site: cross-site | same-origin | same-site | none

Description

Sec-Fetch-Site is automatically set by browsers and cannot be forged by JavaScript. Values: 'same-origin' (same origin), 'same-site' (same registrable domain, different scheme/port), 'cross-site' (different registrable domain), 'none' (user-initiated navigation, bookmarks). Combined with Sec-Fetch-Mode and Sec-Fetch-Dest, servers can distinguish legitimate same-site requests from cross-site attacks.

Examples

Same-origin API call
http
GET /api/users HTTP/1.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Cross-site request
http
POST /api/action HTTP/1.1
Sec-Fetch-Site: cross-site
# Server should validate this is expected

Related

Sec-Fetch-ModeSec-Fetch-DestOrigin

Specification

W3C Fetch Metadata – Sec-Fetch-Site specification →