The Origin request header indicates where a fetch originates from. It consists of the protocol scheme, domain name, and port of the originating page.

Syntax and structure

Origin: https://app.example.test:443
Origin: null

Unlike the Referer header, Origin contains no path or query string parameters, protecting user privacy while giving servers necessary CORS information.

When does a browser send Origin?

  1. Cross-Origin Requests: All cross-origin CORS requests (fetch, XMLHttpRequest, fonts).
  2. Same-Origin State-Changing Requests: POST, PUT, DELETE requests (used for CSRF defense).
  3. CORS Preflight Requests: The OPTIONS preflight request always carries Origin.

The ‘null’ origin scenario

Browsers send Origin: null in specific security-sandboxed contexts:

  • Requests originating from local files (file:// protocol).
  • Sandboxed <iframe> elements without allow-same-origin.
  • Cross-origin redirects resulting in privacy strips.

APIs should avoid whitelisting Access-Control-Allow-Origin: null as it allows untrusted sandboxed documents to bypass origin controls.

How to simulate Origin with curl

Simulate a browser cross-origin request using curl:

curl -i https://api.example.test/v1/data \
  -H "Origin: https://app.example.test"

Key takeaway

The Origin header provides the scheme, host, and port of the requesting client context. It is set automatically by browsers and cannot be modified by JavaScript, serving as the foundational anchor for CORS evaluation.