CORS · Request header
Origin
The origin (scheme + host + port) of the request.
What is Origin?
The browser sets Origin on cross-origin requests, and on same-origin non-GET requests. Servers use it to decide whether to accept the request and what Access-Control-Allow-Origin value to echo back.
Typical usage
Read by servers implementing CORS.
Examples
Origin: https://app.example.comSpecification
Fetch Standard
Frequently asked questions
What is the Origin HTTP header?
The browser sets Origin on cross-origin requests, and on same-origin non-GET requests. Servers use it to decide whether to accept the request and what Access-Control-Allow-Origin value to echo back.
Is Origin a request or response header?
Origin is a request header — the client sends it to the server. Read by servers implementing CORS.
What does a Origin header look like?
A typical Origin header looks like: Origin: https://app.example.com.
Related headers
Access-Control-Allow-Origin
Which origins may read this response cross-origin.
Referer
The URL of the previous page that led to this request.
Access-Control-Allow-Methods
Which HTTP methods are allowed on the cross-origin resource.
Access-Control-Allow-Headers
Which request headers may be used in the actual cross-origin request.
Access-Control-Allow-Credentials
Whether cookies and Authorization can be sent cross-origin.
Access-Control-Max-Age
How long the browser may cache the preflight response.