field Registered
Verified 2026-09-18 · registry updated
2026-08-28Origin
Identifies the origin that initiated a browser request.
Use Origin in CORS and CSRF checks. It can be the value null for some sandboxed or opaque-origin contexts.
httpheadercorscsrfsecurity
Reference (http)
Origin: https://app.example.com
Use Origin in CORS and CSRF checks. It can be the value null for some sandboxed or opaque-origin contexts.
Common mistakes
- Allowing requests based on a loose string prefix instead of parsing and comparing origins.
IANA registry: http-fields/field-names
Registry reference: RFC 6454: The Web Origin Concept