The HTTPOriginrequest header indicates theorigin (scheme, hostname, and port) thatcaused the request.For example, if a user agent needs to request resources included in a page, or fetched by scripts that it executes, then the origin of the page may be included in the request.

Syntax

Origin: nullOrigin: <scheme>://<hostname>Origin: <scheme>://<hostname>:<port>

Directives

null

The origin is "privacy sensitive", or is anopaque origin (specific cases are listed in thedescription section).

<scheme>

The protocol that is used.Usually, it is the HTTP protocol or its secured version, HTTPS.

<hostname>

The domain name or the IP address of the origin server.

<port>Optional

Port number on which the server is listening.If no port is given, the default port for the requested service is implied from the scheme (e.g.,80 for an HTTP URL).

Description

TheOrigin header is similar to theReferer header, but does not disclose the path, and may benull.It is used to provide the security context for the origin request, except in cases where the origin information would be sensitive or unnecessary.

Broadly speaking, user agents add theOrigin request header to:

• cross origin requests.
• same-origin requests except forGET orHEAD requests (i.e., they are added to same-originPOST,OPTIONS,PUT,PATCH, andDELETE requests).

There are some exceptions to the above rules; for example, if a cross-originGET orHEAD request is made inno-cors mode, theOrigin header will not be added.

TheOrigin header value may benull in a number of cases, including (non-exhaustively):

• Origins whosescheme is not one ofhttp,https,ftp,ws,wss, orgopher (includingblob,file anddata).
• Cross-origin images and media data, including that in<img>,<video> and<audio> elements.
• Documents created programmatically usingcreateDocument(), generated from adata: URL, or that do not have a creator browsing context.
• Redirects across origins.
• Documents served with theContent-Security-Policysandbox directive whose value doesn't includeallow-same-origin.
• iframes with a sandbox attribute whose value doesn't includeallow-same-origin.
• Responses that are network errors.
• Referrer-Policy set tono-referrer for non-cors request modes (e.g., basic form posts).

Examples

Origin: https://developer.mozilla.org

Origin: https://developer.mozilla.org:80

Specifications

Browser compatibility

See also

• Host
• Referer
• Same-origin policy
• When do browsers send the Origin header? When do browsers set the origin to null? (Stack Overflow)