Aforbidden request header is anHTTP header name-value pair that cannot be set or modified programmatically in a request. For headers forbidden to be modified in responses, seeforbidden response header name.

Modifying such headers is forbidden because the user agent retains full control over them.For example, theDate header is a forbidden request header, so this code cannot set the messageDate field:

fetch("https://httpbin.org/get", {  headers: {    Date: new Date().toUTCString(),  },});

Names starting withSec- are reserved for creating new headers safe fromAPIs that grant developers control over headers, such asfetch().Forbidden headers are one of the following:

• Accept-Charset
• Accept-Encoding
• Access-Control-Request-Headers
• Access-Control-Request-Method
• Connection
• Content-Length
• Cookie
• Date
• DNT
• Expect
• Host
• Keep-Alive
• Origin
• Proxy- headers
• Sec- headers
• Referer
• Set-Cookie
• TE
• Trailer
• Transfer-Encoding
• Upgrade
• Via
• X-HTTP-Method, but only when it contains a forbidden method name (CONNECT,TRACE,TRACK)
• X-HTTP-Method-Override, but only when it contains a forbidden method name
• X-Method-Override, but only when it contains a forbidden method name

See also

• Related glossary terms:
  • Forbidden response header name