Origin
request headercors
Sent by browsers to say which origin — scheme, host and port — a request comes from.
Browsers add Origin to CORS requests and to any request whose method isn't GET or HEAD. Unlike Referer, it never includes a path. Servers use it to make CORS decisions and as a cheap CSRF check: a state-changing request whose Origin isn't yours didn't come from your pages.
Syntax
Origin: <scheme>://<host>[:<port>] or Origin: null
Defined in RFC 6454 — The Web Origin Concept.
Examples
Origin: https://app.example.com
a page on app.example.com
Origin: null
sandboxed iframes, file:// pages, some redirects
Good to know
- Scripts can't set or change Origin; browsers control it.
- Non-browser clients such as curl don't send it — treat a missing Origin as 'not a browser', not as trusted.
- Compare the full origin, not a substring:
evil-example.comcontainsexample.com.
Further reading: CORS errors explained
Who sets Origin
Browsers set Origin themselves; page scripts can't change it. To simulate one while testing, curl lets you send any value: curl -H "Origin: https://app.example.com" -I https://api.example.com/.
Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
What's the difference between Origin and Referer?
Origin holds only scheme, host and port, and browsers send it for CORS and non-GET requests. Referer can hold the full URL of the previous page and is shaped by Referrer-Policy.