Fetch Metadata Request Fields

Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User describe how a browser initiated a request.

Use Fetch Metadata as a defense-in-depth request policy, especially to reject cross-site state-changing requests. Provide a deliberate fallback for clients that do not send the fields.

httpbrowsersecuritycsrfheader

Reference (http)

Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty

Use Fetch Metadata as a defense-in-depth request policy, especially to reject cross-site state-changing requests. Provide a deliberate fallback for clients that do not send the fields.

Common mistakes

Treating missing fields as proof of safety or using them as a replacement for authentication and CSRF defenses.

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
IANA HTTP Field Name Registry