CODEWITHSUNDEEP
httphttp-headerscors
Max
Max

Reputation: 329

Why is the origin header sent for same-origin requests?

According to https://fetch.spec.whatwg.org/#origin-header :

The Origin header is a version of the Referer header that does not reveal a path. It is used for all HTTP fetches whose request’s response tainting is "cors", as well as those where request’s method is neither GET nor HEAD. Due to compatibility constraints it is not included in all fetches.

As I understand it, in particular, the Origin header should be sent with any same-origin request except GET and HEAD methods. How the Origin header can be useful in this same-origin case? And why the exception is made for the GET and HEAD methods?

Upvotes: 1

Views: 571

Answers (1)

Anne
Anne

Reputation: 7643

It can help as an CSRF mitigation. So you know your own site made the POST. Using Origin as a CSRF mitigation was an afterthought and since it was already deployed for CORS usage, some servers got confused when it was added for GET (at least), which is why it's not included there.

Upvotes: 2

Related Questions